node-opcua CVE-2026-54155

Two distinct exploitation paths exist with different preconditions. For the forged-empty-password attack: the target OPC UA server must have at least one account configured to accept an empty password (or no password validation), and the attacker must know or guess a valid username - empty or default accounts in industrial deployments are the primary risk. For the replay attack: the attacker must have previously captured a valid UserNameIdentityToken ciphertext from a prior OPC UA session (e.g., via network interception). The compounding bypass (verifyClientSignature always returning true) applies specifically when the secure channel is negotiated with SecurityMode=None, which is a non-default but common misconfiguration in OPC UA deployments where client certificate management is avoided. Limiting factors: CVSS AC:H reflects that neither attack path is trivially universal - the empty-password variant is limited to servers with weak account policies, and the replay variant requires prior credential capture. Authentication is not required by the attacker (PR:N), and no user interaction is needed (UI:N). The OPC UA port must be reachable from the attacker's network position.

The CVSS vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L yields a base score reported inconsistently as both 8.1 and 7.7 in the source data - both cite the same vector, suggesting a transcription or rounding discrepancy; the computed value is approximately 8.3. The AC:H rating is justified: the empty-password variant requires that at least one account on the target server accepts an empty password, while the replay variant requires prior capture of a valid session token - neither is a zero-effort precondition. However, the PoC attack sequence has been dynamically confirmed by the reporter, and the step-by-step logic requires only publicly available information (the server's own public key, obtained via unauthenticated GetEndpoints) and standard RSA-OAEP encryption, lowering the practical bar considerably. No KEV listing has been confirmed, and no EPSS score was provided in the source data, so exploitation breadth in the wild is unknown. For OPC UA deployments that expose the server port to untrusted networks or that use SecurityMode=None (a known anti-pattern in industrial environments), this is a real, high-priority issue. Deployments that enforce strong SecurityMode, disallow empty passwords, and restrict OPC UA port access to trusted subnets face substantially lower residual risk. No vendor-released patch exists at time of analysis, which elevates urgency for workarounds.

An attacker with network access to an OPC UA server running node-opcua <= 2.165.0 first calls GetEndpoints without authentication to retrieve the server's RSA public key. The attacker then opens a secure channel with SecurityMode=None, creates a session, crafts a 4-byte payload where the length field equals the server nonce length (32), RSA-OAEP-encrypts it with the server's public key, and submits it as a UserNameIdentityToken in an ActivateSession call - causing the server to compute a password of empty string and invoke isValidUser with that value. A proof-of-concept attack sequence has been dynamically confirmed by the reporter, and the attack does not require the server private key or any prior credential.