CVE-2022-37012

moderate-risk
Published 2023-03-29

This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Unified Automation OPC UA C++ Demo Server 1.7.6-537. Authentication is not required to exploit this vulnerability. The specific flaw exists within the OpcUa_SecureListener_ProcessSessionCallRequest method. A crafted OPC UA message can force the server to incorrectly update a reference count. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-16927.

Do I need to act?

~
6.9% chance of exploitation in next 30 days
EPSS score — moderate exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
7
CVSS 7.5/10 High
NETWORK / LOW complexity

Affected Products (1)

Opc Ua C\+\+ Demo Server

Affected Vendors

Unified-Automation

References (4)

Release Notes https://documentation.unified-automation.com/uasdkcpp/1.7.7/CHANGELOG.txt
Third Party Advisory https://www.zerodayinitiative.com/advisories/ZDI-22-1030/
Release Notes https://documentation.unified-automation.com/uasdkcpp/1.7.7/CHANGELOG.txt
Third Party Advisory https://www.zerodayinitiative.com/advisories/ZDI-22-1030/
40
/ 100
moderate-risk
Severity 26/34 · High
Exploitability 9/34 · Low
Exposure 5/34 · Minimal