EUVD-2026-53673
GHSA-5xh2-h93h-x38x
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-reachable unauthenticated DoS under default OPC UA server config; no confidentiality or integrity impact applies, only availability.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
4DescriptionCVE.org
An issue in open62541 v.1.5.5 and before allows a remote attacker to cause a denial of service via the NodeManagement type-instantiation logic component
AnalysisAI
Uncontrolled resource consumption in open62541 v1.5.5 and earlier allows unauthenticated remote attackers to crash or exhaust resources on OPC UA servers by sending crafted NodeManagement type-instantiation requests. The flaw resides in the server-side node management service logic and is exploitable over the network with no privileges or user interaction under the default access control configuration. No CISA KEV listing exists as of analysis, but the SSVC framework classifies the attack as automatable with a proof-of-concept present; the EPSS score of 0.25% (16th percentile) indicates limited observed exploitation in the wild despite that automation potential.
Technical ContextAI
open62541 is a widely-adopted open-source C implementation of OPC UA (OPC Unified Architecture, IEC 62541), a machine-to-machine communication protocol used extensively in industrial automation, SCADA systems, and IIoT device integration. The vulnerable component is the NodeManagement service handler (ua_services_nodemanagement.c), which processes AddNodes and AddReferences operations that allow OPC UA clients to dynamically create nodes in the server's address space. CWE-400 (Uncontrolled Resource Consumption) identifies the root cause as the type-instantiation logic within this handler failing to impose adequate bounds on resource usage when processing malformed or adversarially crafted requests, leading to memory or CPU exhaustion. The referenced ua_accesscontrol_default.c file indicates the vulnerability is reachable under default server configurations, which do not require OPC UA session authentication before accepting NodeManagement service calls. The CPE string in the input is a placeholder (n/a) and does not provide granular package-level coverage; version-specific impact must be verified against the open62541 GitHub repository directly.
RemediationAI
No specific patched release version is identified in the available data; the upstream fix status must be verified directly at the GitHub issue https://github.com/open62541/open62541/issues/8133. Operators should monitor the open62541 release page and upgrade to the first tagged release that resolves this issue once published. As a primary compensating control, restrict network access to OPC UA endpoints (TCP port 4840 by default) using host-based or perimeter firewall rules, limiting connectivity to trusted engineering workstations and authorized OPC UA clients only - this directly neutralizes the AV:N attack vector at network cost of blocking all unauthenticated external OPC UA access. If the application does not require dynamic node creation at runtime, disabling or refusing NodeManagement service calls (AddNodes/AddReferences) server-side via application-layer filtering eliminates the vulnerable code path with the trade-off of breaking legitimate clients that depend on dynamic address space modification. Enabling stricter authentication requirements beyond the default configuration (replacing ua_accesscontrol_default.c behavior with session-level authentication enforcement) may reduce exploitability but has interoperability implications for existing OPC UA clients. Vendor-supplied advisories from downstream OEM integrators should be consulted if open62541 is embedded in a third-party product.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today