What is the CVSS score of CVE-2026-67871?

CVE-2026-67871 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

Which versions of S2OPC Toolkit are affected by CVE-2026-67871?

Systerel S2OPC Toolkit 1.7.3 contains a critical availability vulnerability allowing remote unauthenticated denial-of-service attacks against industrial control systems, creating significant…

How to fix or mitigate CVE-2026-67871?

Within 24 hours, identify and inventory all Systerel S2OPC Toolkit 1.7.3 instances across your infrastructure and immediately restrict network access to affected OPC UA endpoints using firewall rules; limit access to only trusted internal sources and disable external connectivity. Within 7 days, implement network segmentation to isolate S2OPC instances from untrusted segments, disable the AddNodes RPC service if operationally feasible, and deploy monitoring for exploitation attempts (unusual or malformed AddNodes requests). Within 30 days, establish vendor contact and patch-tracking procedures; monitor Systerel security advisories and test infrastructure to enable rapid deployment once a patch becomes available.

S2OPC Toolkit CVE-2026-67871

EUVD-2026-53679 HIGH

Classic Buffer Overflow (CWE-120)

2026-08-05 mitre

GHSA-hp7g-qmxv-gvfg

Buffer Overflow Denial Of Service N A

7.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Network-reachable OPC UA AddNodes handler requires no authentication; impact is availability-only crash with no confidentiality or integrity consequence.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 13:25 vuln.today

CVSS changed

Aug 06, 2026 - 13:22 NVD

7.5 (HIGH)

CVE Published

Aug 05, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 05, 2026 - 00:00 cve.org

HIGH 7.5

DescriptionCVE.org

Buffer Overflow vulnerability in Systerel S2OPC 1.7.3 allows a remote attacker to cause a denial of service via the AddNodes, address_space_bs.c, sopc_node_mgt_helper_internal.c, and toolkit_test_server

AnalysisAI

Remote unauthenticated denial of service in Systerel S2OPC Toolkit 1.7.3 is exploitable via the OPC UA AddNodes service, triggering a classic buffer overflow (CWE-120) in address_space_bs.c and sopc_node_mgt_helper_internal.c that crashes the server. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms this is reachable from the network without credentials or user interaction, making it trivially automatable against exposed OPC UA endpoints. No public exploit code or CISA KEV listing has been identified at time of analysis, though the impact is particularly acute in OT/ICS environments where S2OPC is deployed, as availability loss in industrial control infrastructure can translate to physical process disruption.

Technical ContextAI

S2OPC (Safe and Secure OPC) is an open-source OPC UA (Open Platform Communications Unified Architecture) stack developed by Systerel, targeting safety-critical and real-time industrial environments. OPC UA is an IEC 62541 standard machine-to-machine protocol used extensively in SCADA, DCS, and industrial IoT deployments. The vulnerability is rooted in CWE-120 (Buffer Copy without Checking Size of Input), a classic memory safety failure where input from the OPC UA AddNodes service request is copied into a fixed-size buffer without proper bounds validation. The affected source files - address_space_bs.c (B method implementation for the OPC UA address space) and sopc_node_mgt_helper_internal.c (internal node management helpers) - are core server-side components responsible for processing client requests to add new nodes to the server's address space. The CPE data provided is a placeholder (cpe:2.3:a:n/a:n/a) and does not provide vendor-attributed CPE strings; the affected product is definitively identified as S2OPC Toolkit version 1.7.3 per the CVE description and GitHub source references tagged at S2OPC_Toolkit_1.7.3.

RemediationAI

No vendor-released patched version has been independently confirmed from the available data. The upstream issue is tracked at https://gitlab.com/systerel/S2OPC/-/work_items/1787 - monitor this for a fix release and apply promptly once a patched version is tagged. Until a patch is available, operators should implement network-layer controls to restrict access to the OPC UA port (default TCP 4840) to trusted clients only using firewall ACLs or OPC UA security channel enforcement, accepting the trade-off of reduced interoperability with unenrolled clients. Enabling OPC UA Security Mode (Sign or SignAndEncrypt) with certificate-based authentication may limit the exploitable surface if the overflow is only reachable from unauthenticated or unsigned sessions - however, this is not confirmed from available data and should be validated against the upstream issue. Deploying OPC UA servers behind a protocol-aware industrial DMZ or OPC UA gateway that validates AddNodes requests can provide a compensating control with the trade-off of added latency and architectural complexity. Do not expose S2OPC 1.7.3 servers directly to untrusted or internet-facing networks.