S2Opc
Monthly
Improper certificate trust validation in Systerel S2OPC allows remote attackers to have well-formed but untrusted X.509 certificates accepted as trusted, undermining the OPC UA secure channel authentication model. CVSS 7.3 reflects network-reachable, unauthenticated exploitation with low impact across confidentiality, integrity, and availability, and no public exploit identified at time of analysis. The flaw is reported by GitLab and tracked in Systerel's public issue tracker, with no CISA KEV listing.
Use-after-free in Systerel S2OPC OPC UA stack up to version 1.7.3 allows remote low-privileged attackers to crash the OPC UA server by supplying a crafted EventFilter argument to the subscription monitored-item handler, resulting in a denial of service against industrial communication endpoints. No confirmed active exploitation (not in CISA KEV), though a proof-of-concept is publicly available per the referenced GitLab work item, materially lowering the exploitation barrier. In OT/ICS environments, even a VA:L crash impact can carry significant operational consequences by halting process monitoring or control communications.
Out-of-bounds read in S2OPC's AddNodes service allows remote attackers to trigger memory read violations via a crafted UserAccessLevel argument, causing low-severity availability impact on vulnerable server instances running version 1.7.3 and earlier. The flaw resides in SOPC_NodeMgtHelperInternal_AddVariableNodeAttributes within the address space management layer of this OPC UA stack, which is deployed primarily in industrial automation and ICS/SCADA environments. A public proof-of-concept exploit has been disclosed, though high attack complexity (AC:H) limits opportunistic exploitation; no public exploit identified at time of analysis as a KEV-confirmed active threat.
Out-of-bounds read in Systerel S2OPC versions 1.7.0 through 1.7.3 allows a local, low-privileged attacker to disrupt the OPC-UA client process by triggering a memory read violation in the DeleteMonitoredItemsRequest handler state machine function. The flaw is confined to the client-side wrapper component and results in an availability impact rather than code execution or data exfiltration. A public proof-of-concept exploit has been released on GitHub, and the vendor has not responded to coordinated disclosure, leaving no official patch confirmed at time of analysis.
Certificate trust bypass in S2OPC versions 1.5.0 through 1.x (prior to 2.0.0) allows a remote attacker to have certificates signed by an expired root CA accepted as fully trusted due to missing validity period enforcement in the CycloneCrypto wrapper layer. The flaw affects OPC UA communications protected by this library, enabling potential interception or tampering of industrial protocol traffic. No public exploit code has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog.
Improper certificate revocation checking in S2OPC's CycloneCrypto wrapper permits OPC UA connections authenticated with revoked certificates. The library evaluates only the first Certificate Revocation List (CRL) matching a given CA and silently discards any additional valid CRLs issued by that same CA - meaning a certificate listed exclusively in a secondary CRL passes validation unchallenged. With CVSS 5.6 (AV:N/AC:H/PR:N/UI:N), all published versions of systerel/s2opc are affected per CPE. No public exploit code or CISA KEV listing has been identified at time of analysis.
Improper certificate trust validation in Systerel S2OPC allows remote attackers to have well-formed but untrusted X.509 certificates accepted as trusted, undermining the OPC UA secure channel authentication model. CVSS 7.3 reflects network-reachable, unauthenticated exploitation with low impact across confidentiality, integrity, and availability, and no public exploit identified at time of analysis. The flaw is reported by GitLab and tracked in Systerel's public issue tracker, with no CISA KEV listing.
Use-after-free in Systerel S2OPC OPC UA stack up to version 1.7.3 allows remote low-privileged attackers to crash the OPC UA server by supplying a crafted EventFilter argument to the subscription monitored-item handler, resulting in a denial of service against industrial communication endpoints. No confirmed active exploitation (not in CISA KEV), though a proof-of-concept is publicly available per the referenced GitLab work item, materially lowering the exploitation barrier. In OT/ICS environments, even a VA:L crash impact can carry significant operational consequences by halting process monitoring or control communications.
Out-of-bounds read in S2OPC's AddNodes service allows remote attackers to trigger memory read violations via a crafted UserAccessLevel argument, causing low-severity availability impact on vulnerable server instances running version 1.7.3 and earlier. The flaw resides in SOPC_NodeMgtHelperInternal_AddVariableNodeAttributes within the address space management layer of this OPC UA stack, which is deployed primarily in industrial automation and ICS/SCADA environments. A public proof-of-concept exploit has been disclosed, though high attack complexity (AC:H) limits opportunistic exploitation; no public exploit identified at time of analysis as a KEV-confirmed active threat.
Out-of-bounds read in Systerel S2OPC versions 1.7.0 through 1.7.3 allows a local, low-privileged attacker to disrupt the OPC-UA client process by triggering a memory read violation in the DeleteMonitoredItemsRequest handler state machine function. The flaw is confined to the client-side wrapper component and results in an availability impact rather than code execution or data exfiltration. A public proof-of-concept exploit has been released on GitHub, and the vendor has not responded to coordinated disclosure, leaving no official patch confirmed at time of analysis.
Certificate trust bypass in S2OPC versions 1.5.0 through 1.x (prior to 2.0.0) allows a remote attacker to have certificates signed by an expired root CA accepted as fully trusted due to missing validity period enforcement in the CycloneCrypto wrapper layer. The flaw affects OPC UA communications protected by this library, enabling potential interception or tampering of industrial protocol traffic. No public exploit code has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog.
Improper certificate revocation checking in S2OPC's CycloneCrypto wrapper permits OPC UA connections authenticated with revoked certificates. The library evaluates only the first Certificate Revocation List (CRL) matching a given CA and silently discards any additional valid CRLs issued by that same CA - meaning a certificate listed exclusively in a secondary CRL passes validation unchallenged. With CVSS 5.6 (AV:N/AC:H/PR:N/UI:N), all published versions of systerel/s2opc are affected per CPE. No public exploit code or CISA KEV listing has been identified at time of analysis.