PT-2022-23757 · Unified Automation · Unified Automation Opc Ua C++ Demo Server

20Urdjk · Published 2022-07-28 · Updated 2023-04-06 · CVE-2022-37012

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Unified Automation OPC UA C++ Demo Server version 1.7.6-537

Description This issue allows remote attackers to create a denial-of-service condition on affected installations. Authentication is not required to exploit this issue. The specific flaw exists within the OpcUa SecureListener ProcessSessionCallRequest method. A crafted OPC UA message can force the server to incorrectly update a reference count, allowing an attacker to create a denial-of-service condition on the system.

Recommendations For Unified Automation OPC UA C++ Demo Server version 1.7.6-537, as a temporary workaround, consider disabling the OpcUa SecureListener ProcessSessionCallRequest method until a patch is available. Restrict access to the server to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Weakness Enumeration

CWE-911

Related Identifiers

CVE-2022-37012

ZDI-22-1030

Affected Products

Unified Automation Opc Ua C++ Demo Server

References · 5

• https://osv.dev/vulnerability/CVE-2022-37012 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-22-1030 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-37012 · Security Note
• https://documentation.unified-automation.com/uasdkcpp/1.7.7/CHANGELOG.txt · Note
• https://t.me/cibsecurity/61087 · Telegram Post