EUVD-2026-68359
GHSA-x4v2-7pqm-v4jq
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable via OPC UA subscription API, but PR:L reflects required authenticated session; impact is limited to a server crash with no confidentiality or integrity exposure.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability was identified in Systerel S2OPC up to 1.7.3. The impacted element is the function monitored_item_event_filter_treatment_bs__init_event_filter_ctx_and_result of the file src/ClientServer/services/bgenc/subscription_mgr.c. Such manipulation of the argument EventFilter leads to use after free. The attack may be performed from remote. The exploit is publicly available and might be used. The name of the patch is a4cee16a851b971be447a6ed531173702c722b99. It is best practice to apply a patch to resolve this issue.
AnalysisAI
Use-after-free in Systerel S2OPC OPC UA stack up to version 1.7.3 allows remote low-privileged attackers to crash the OPC UA server by supplying a crafted EventFilter argument to the subscription monitored-item handler, resulting in a denial of service against industrial communication endpoints. No confirmed active exploitation (not in CISA KEV), though a proof-of-concept is publicly available per the referenced GitLab work item, materially lowering the exploitation barrier. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an established OPC UA session with sufficient rights to create subscriptions and register monitored items with EventFilters - corresponding to PR:L in the CVSS 4.0 vector, meaning at minimum a low-privileged authenticated OPC UA client account or an anonymous session if the server permits anonymous subscription creation. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 base score of 5.3 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N) reflects a moderate, network-exploitable denial-of-service requiring low privileges but no special attack prerequisites beyond an authenticated OPC UA session with subscription rights. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply upstream fix commit a4cee16a851b971be447a6ed531173702c722b99, available at https://gitlab.com/systerel/S2OPC/-/merge_requests/1839. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Improper certificate trust validation in Systerel S2OPC allows remote attackers to have well-formed but untrusted X.509
Out-of-bounds read in S2OPC's AddNodes service allows remote attackers to trigger memory read violations via a crafted U
Out-of-bounds read in Systerel S2OPC versions 1.7.0 through 1.7.3 allows a local, low-privileged attacker to disrupt the
Certificate trust bypass in S2OPC versions 1.5.0 through 1.x (prior to 2.0.0) allows a remote attacker to have certifica
Improper certificate revocation checking in S2OPC's CycloneCrypto wrapper permits OPC UA connections authenticated with
Same weakness CWE-416 – Use After Free
View allSame technique Memory Corruption
View allShare
External POC / Exploit Code
Leaving vuln.today