Eclipse Milo
Monthly
Session security diagnostics nodes in Eclipse Milo 0.6.0 through 1.1.4 expose sensitive OPC UA session metadata without enforcing any authorization checks, a CWE-862 (Missing Authorization) flaw. An unauthenticated anonymous client connecting over a None/None (no-security) endpoint can enable the diagnostics subsystem with no certificate or credentials whatsoever; separately, a client presenting a trusted application certificate over SignAndEncrypt can read the SessionSecurityDiagnosticsArray for all active server sessions, harvesting usernames, login history, authentication mechanisms, session security modes and policies, and public client certificates. No public exploit code exists and the vulnerability is not listed in CISA KEV, but the zero-authentication path and prevalence of None/None endpoints in legacy OT/IIoT environments meaningfully lower the exploitation barrier.
Silent authorization bypass in Eclipse Milo OPC UA server SDK versions 1.0.0-1.1.4 allows anonymous network clients to invoke protected methods, read role-permission metadata, and delete protected nodes. The defect is a missing field copy in `OpcUaServerConfig.copy()`: when servers construct their running configuration via this method, the configured `RoleMapper` is silently dropped, causing the `DefaultAccessController` to receive empty role ID lists for every session and skip all role-permission enforcement. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Unauthenticated remote denial-of-service in Eclipse Milo 0.6.0-1.1.4 allows any network-accessible client to exhaust the OPC UA server's off-heap direct memory pool by repeatedly sending incomplete UASC message chunks and disconnecting before message assembly completes. The UASC server-side asymmetric handler and ChunkDecoder fail to invoke ReferenceCountUtil.safeRelease() on retained Netty ByteBuf objects when the channel lifecycle ends, causing unbounded off-heap memory accumulation. No authentication is required and no special server configuration is necessary; the fix commit is publicly available on GitHub, serving as an effective blueprint for exploitation, though no standalone POC tool or CISA KEV listing has been identified at time of analysis.
Authorization bypass in Eclipse Milo's OPC UA Call service (versions 1.0.0-1.1.4) permits unauthenticated or low-privileged OPC UA clients to invoke server-side methods they are explicitly denied access to. The server correctly computes per-method authorization for a mixed batch CallRequest but then dispatches the original unfiltered batch - including denied methods - to address-space handlers, rendering the authorization check effectively inert. No active exploitation is confirmed and no public exploit code has been identified, but the attack requires only standard OPC UA client tooling and zero authentication, making exploitation trivially accessible to any network-reachable client.
Password recovery in Eclipse Milo (the open-source OPC UA SDK for Java) versions 0.6.0 through 1.1.4 allows an on-path attacker to break username-token confidentiality via a Bleichenbacher-style padding oracle. The server returns distinguishable error responses for invalid RSA PKCS#1 v1.5 padding versus other authentication failures during username-token processing, so an attacker who captures a victim's Basic128Rsa15-encrypted username token can send repeated unauthenticated ActivateSession requests to recover the cleartext password and then authenticate as the victim. No public exploit identified at time of analysis and it is not listed in CISA KEV; the weakness and its upstream fix are confirmed by the Eclipse Foundation.
Unauthenticated remote clients can permanently exhaust the global monitored-item quota in Eclipse Milo OPC UA SDK versions 1.0.0 through 1.1.4, effectively preventing all clients from creating new monitored items until the server is restarted. The attack combines two defects: the server's ExtensionObject decoder lacks recursion-depth enforcement, enabling deeply nested PubSub structures in a CreateMonitoredItems event filter to trigger a JVM StackOverflowError, and the quota accounting code is not exception-safe against unchecked JVM Errors, so the reserved slot is never reclaimed. No public exploit code has been identified and this CVE is absent from the CISA KEV catalog; however, the CVSS 4.0 vector AV:N/AC:L/PR:N/UI:N confirms the attack is network-reachable with no authentication or complexity barriers.
Session security diagnostics nodes in Eclipse Milo 0.6.0 through 1.1.4 expose sensitive OPC UA session metadata without enforcing any authorization checks, a CWE-862 (Missing Authorization) flaw. An unauthenticated anonymous client connecting over a None/None (no-security) endpoint can enable the diagnostics subsystem with no certificate or credentials whatsoever; separately, a client presenting a trusted application certificate over SignAndEncrypt can read the SessionSecurityDiagnosticsArray for all active server sessions, harvesting usernames, login history, authentication mechanisms, session security modes and policies, and public client certificates. No public exploit code exists and the vulnerability is not listed in CISA KEV, but the zero-authentication path and prevalence of None/None endpoints in legacy OT/IIoT environments meaningfully lower the exploitation barrier.
Silent authorization bypass in Eclipse Milo OPC UA server SDK versions 1.0.0-1.1.4 allows anonymous network clients to invoke protected methods, read role-permission metadata, and delete protected nodes. The defect is a missing field copy in `OpcUaServerConfig.copy()`: when servers construct their running configuration via this method, the configured `RoleMapper` is silently dropped, causing the `DefaultAccessController` to receive empty role ID lists for every session and skip all role-permission enforcement. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Unauthenticated remote denial-of-service in Eclipse Milo 0.6.0-1.1.4 allows any network-accessible client to exhaust the OPC UA server's off-heap direct memory pool by repeatedly sending incomplete UASC message chunks and disconnecting before message assembly completes. The UASC server-side asymmetric handler and ChunkDecoder fail to invoke ReferenceCountUtil.safeRelease() on retained Netty ByteBuf objects when the channel lifecycle ends, causing unbounded off-heap memory accumulation. No authentication is required and no special server configuration is necessary; the fix commit is publicly available on GitHub, serving as an effective blueprint for exploitation, though no standalone POC tool or CISA KEV listing has been identified at time of analysis.
Authorization bypass in Eclipse Milo's OPC UA Call service (versions 1.0.0-1.1.4) permits unauthenticated or low-privileged OPC UA clients to invoke server-side methods they are explicitly denied access to. The server correctly computes per-method authorization for a mixed batch CallRequest but then dispatches the original unfiltered batch - including denied methods - to address-space handlers, rendering the authorization check effectively inert. No active exploitation is confirmed and no public exploit code has been identified, but the attack requires only standard OPC UA client tooling and zero authentication, making exploitation trivially accessible to any network-reachable client.
Password recovery in Eclipse Milo (the open-source OPC UA SDK for Java) versions 0.6.0 through 1.1.4 allows an on-path attacker to break username-token confidentiality via a Bleichenbacher-style padding oracle. The server returns distinguishable error responses for invalid RSA PKCS#1 v1.5 padding versus other authentication failures during username-token processing, so an attacker who captures a victim's Basic128Rsa15-encrypted username token can send repeated unauthenticated ActivateSession requests to recover the cleartext password and then authenticate as the victim. No public exploit identified at time of analysis and it is not listed in CISA KEV; the weakness and its upstream fix are confirmed by the Eclipse Foundation.
Unauthenticated remote clients can permanently exhaust the global monitored-item quota in Eclipse Milo OPC UA SDK versions 1.0.0 through 1.1.4, effectively preventing all clients from creating new monitored items until the server is restarted. The attack combines two defects: the server's ExtensionObject decoder lacks recursion-depth enforcement, enabling deeply nested PubSub structures in a CreateMonitoredItems event filter to trigger a JVM StackOverflowError, and the quota accounting code is not exception-safe against unchecked JVM Errors, so the reserved slot is never reclaimed. No public exploit code has been identified and this CVE is absent from the CISA KEV catalog; however, the CVSS 4.0 vector AV:N/AC:L/PR:N/UI:N confirms the attack is network-reachable with no authentication or complexity barriers.