GHSA-gr4c-5rq6-cgh3MediumCVSS 5.3

OPC UA applications can allow a remote attacker to determine a Server's private key

Published
October 16, 2018
Last Modified
January 9, 2023

🔗 CVE IDs covered (1)

CVE-2018-7559 →

📋 Description

An issue was discovered in OPC UA .NET Standard Stack and Sample Code before GitHub commit 2018-04-12, and OPC UA .NET Legacy Stack and Sample Code before GitHub commit 2018-03-13. A vulnerability in OPC UA applications can allow a remote attacker to determine a Server's private key by sending carefully constructed bad UserIdentityTokens as part of an oracle attack.

🎯 Affected products1

  • nuget/OPCFoundation.NetStandard.Opc.Ua:<= 1.3.352.11

🔗 References (6)