PT-2021-22996 · Softing Industrial Automation · Uatoolkit Embedded

Published 2021-11-10 · Updated 2021-11-16 · CVE-2021-40872

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Softing Industrial Automation uaToolkit Embedded versions prior to 1.40

Description An issue allows remote attackers to cause a denial of service (DoS) or login as an anonymous user by sending crafted messages to an OPC/UA server. The server process may crash unexpectedly due to an invalid type cast and must be restarted.

Recommendations For versions prior to 1.40, update to version 1.40 or later to resolve the issue. As a temporary workaround, consider implementing additional security checks to prevent anonymous login and restricting access to the OPC/UA server to minimize the risk of exploitation.

Fix

Type Confusion

Weakness Enumeration

CWE-843

Related Identifiers

CVE-2021-40872

Affected Products

Uatoolkit Embedded

References · 5

• https://industrial.softing.com/fileadmin/sof-files/pdf/ia/support/Security_Bulletin_CVE-2021-40872.pdf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-40872 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-40872 · Security Note
• https://industrial.softing.com · Vendor Advisory
• https://t.me/cibsecurity/32231 · Telegram Post