EUVD-2026-50410
GHSA-xph3-r29g-fwfg
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Agrees with provided vector: MitM positioning raises AC:H; no attacker authentication needed (PR:N); partial CIA impacts from session interception on a scoped OPC UA connection.
Primary rating from Vendor (GitLab).
CVSS VectorVendor: GitLab
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Lifecycle Timeline
2DescriptionCVE.org
Improper validity period check for root issuer certificate in CycloneCrypto cryptographic wrapper of S2OPC allows a certificate issued by this root issuer to be considered trusted
AnalysisAI
Certificate trust bypass in S2OPC versions 1.5.0 through 1.x (prior to 2.0.0) allows a remote attacker to have certificates signed by an expired root CA accepted as fully trusted due to missing validity period enforcement in the CycloneCrypto wrapper layer. The flaw affects OPC UA communications protected by this library, enabling potential interception or tampering of industrial protocol traffic. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to occupy a network-adjacent or on-path position between communicating S2OPC endpoints - passive sniffing alone is insufficient; active traffic interception (MitM) is necessary. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD CVSS 3.1 score of 5.6 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L) reflects meaningful but bounded risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with network access between an S2OPC client and server - for example via ARP poisoning, rogue access point, or compromised network switch on an OT segment - presents a TLS certificate signed by an expired root CA that the legitimate S2OPC peer has in its trust store. Because S2OPC's CycloneCrypto wrapper skips the validity period check on the root issuer, the certificate is accepted as trusted, enabling the attacker to establish a trusted OPC UA session and intercept or inject industrial protocol messages. … |
| Remediation | Upgrade to S2OPC 2.0.0 or later, which contains the vendor-released patch for this flaw; this is the primary and recommended remediation. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Improper certificate trust validation in Systerel S2OPC allows remote attackers to have well-formed but untrusted X.509
Out-of-bounds read in S2OPC's AddNodes service allows remote attackers to trigger memory read violations via a crafted U
Out-of-bounds read in Systerel S2OPC versions 1.7.0 through 1.7.3 allows a local, low-privileged attacker to disrupt the
Improper certificate revocation checking in S2OPC's CycloneCrypto wrapper permits OPC UA connections authenticated with
Same weakness CWE-295 – Improper Certificate Validation
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today