EUVD-2026-60552
GHSA-jrr4-6mjm-2xj8
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable OPC UA service reached before authentication where anonymous sessions are allowed (PR:N), low-complexity trigger of the filter parser (AC:L), and heap-write RCE yielding full C/I/A compromise of the server process.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
4DescriptionCVE.org
A heap-based out-of-bounds write vulnerability exists in S2OPC 1.7.3 in server-side EventFilter handling during CreateMonitoredItems processing. This allows a remote attacker to execute arbitrary code.
AnalysisAI
Remote code execution in Systerel S2OPC 1.7.3 arises from a heap out-of-bounds write in the server-side EventFilter handling path exercised during CreateMonitoredItems processing. A remote attacker who can reach the OPC UA server endpoint and open a session on an events-enabled server can corrupt heap memory to achieve arbitrary code execution with the privileges of the server process. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires reaching an S2OPC 1.7.3 OPC UA server over the network and establishing a session sufficient to invoke the CreateMonitoredItems service, then supplying a malicious EventFilter where-clause - so the server MUST have event/alarm subscription support enabled (the code path exercised by the demo_server_alarms sample); a server that does not expose event notifications does not reach the vulnerable handler. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals are mixed and should be weighed rather than taken from the headline number alone. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patched version is independently confirmed from the provided data; a Systerel GitLab work item (https://gitlab.com/systerel/S2OPC/-/work_items/1779) tracks the issue, so upstream remediation is in progress but a specific fixed release could not be verified - do not assume a version number that is not published. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Systerel S2OPC deployments in your environment, document version numbers and whether event monitoring is enabled, and prioritize any systems running version 1.7.3 for network isolation assessment. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-122 – Heap-based Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today