Opcfoundation vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2024-33862 A buffer-management vulnerability in OPC Foundation OPCFoundation.NetStandard.Opc.Ua.Core before 1.05.374.54 could allow remote attackers to exhaust memory resoHigh 7.5 · Jul 5, 2024
• CVE-2023-32787 The OPC UA Legacy Java Stack before 6f176f2 enables an attacker to block OPC UA server applications via uncontrolled resource consumption so that they can no loHigh 7.5 · May 15, 2023
• CVE-2022-44725 OPC Foundation Local Discovery Server (LDS) through 1.04.403.478 uses a hard-coded file path to a configuration file.High 7.8 · Nov 17, 2022
• CVE-2022-33916 OPC UA .NET Standard Reference Server 1.04.368 allows a remote attacker to cause the application to access sensitive information.High 7.5 · Aug 22, 2022
• CVE-2022-29866 OPC UA .NET Standard Stack 1.04.368 allows a remote attacker to exhaust the memory resources of a server via a crafted request that triggers Uncontrolled ResourHigh 7.5 · Jun 16, 2022
• CVE-2022-29864 OPC UA .NET Standard Stack 1.04.368 allows a remote attacker to cause a server to crash via a large number of messages that trigger Uncontrolled Resource ConsumHigh 7.5 · Jun 16, 2022
• CVE-2022-29863 OPC UA .NET Standard Stack 1.04.368 allows remote attacker to cause a crash via a crafted message that triggers excessive memory allocation.High 7.5 · Jun 16, 2022
• CVE-2022-29865 OPC UA .NET Standard Stack allows a remote attacker to bypass the application authentication check via crafted fake credentials.High 7.5 · Jun 16, 2022
• CVE-2022-29862 An infinite loop in OPC UA .NET Standard Stack 1.04.368 allows a remote attackers to cause the application to hang via a crafted message.High 7.5 · Jun 16, 2022
• CVE-2022-30551 OPC UA Legacy Java Stack 2022-04-01 allows a remote attacker to cause a server to stop processing messages by sending crafted messages that exhaust available reHigh 7.5 · May 20, 2022
• CVE-2021-40142 In OPC Foundation Local Discovery Server (LDS) before 1.04.402.463, remote attackers can cause a denial of service (DoS) by sending carefully crafted messages tHigh 7.5 · Aug 27, 2021
• CVE-2021-27432 OPC Foundation UA .NET Standard versions prior to 1.4.365.48 and OPC UA .NET Legacy are vulnerable to an uncontrolled recursion, which may allow an attacker to High 7.5 · May 20, 2021
• CVE-2019-19135 In OPC Foundation OPC UA .NET Standard codebase 1.4.357.28, servers do not create sufficiently random numbers in OPCFoundation.NetStandard.Opc.Ua before 1.4.359High 7.4 · Mar 16, 2020
• CVE-2018-12585 An XXE vulnerability in the OPC UA Java and .NET Legacy Stack can allow remote attackers to trigger a denial of service.High 8.2 · Sep 14, 2018
• CVE-2018-12086 Buffer overflow in OPC UA applications allows remote attackers to trigger a stack overflow with carefully structured requests.High 7.5 · Sep 14, 2018
• CVE-2017-12070 Unsigned versions of the DLLs distributed by the OPC Foundation may be replaced with malicious code.High 8.8 · Jun 14, 2018
• CVE-2017-11672 The OPC Foundation Local Discovery Server (LDS) before 1.03.367 is installed as a Windows Service without adding double quotes around the opcualds.exe executablHigh 7.8 · Jun 13, 2018