PT-2022-20173 · Unknown · Opc Ua Legacy Java Stack

Published 2022-05-20 · Updated 2022-06-27 · CVE-2022-30551

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions OPC UA Legacy Java Stack version 2022-04-01

Description The issue allows a remote attacker to cause a server to stop processing messages by sending crafted messages that exhaust available resources. This can lead to a denial-of-service condition.

Recommendations For OPC UA Legacy Java Stack version 2022-04-01, consider implementing resource limits on incoming messages to prevent exhaustion of available resources as a temporary mitigation measure. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2022-30551

ZDI-22-873

Affected Products

Opc Ua Legacy Java Stack

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2022-30551 · Security Note
• https://osv.dev/vulnerability/CVE-2022-30551 · Vendor Advisory
• https://files.opcfoundation.org/SecurityBulletins/OPC%20Foundation%20Security%20Bulletin%20CVE-2022-30551.pdf · Vendor Advisory
• https://opcfoundation.org · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-22-873 · Security Note
• https://github.com/OPCFoundation/UA-Java-Legacy · Note
• https://t.me/cibsecurity/43049 · Telegram Post