PT-2022-6555 · Softing · Softing Edgeaggregator+5

Sharon Brizinov + 2 · Published 2022-05-10 · Updated 2022-08-23 · CVE-2022-1748

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Softing OPC UA C++ Server SDK (affected versions not specified) Softing Secure Integration Server (affected versions not specified) Softing edgeAggregator (affected versions not specified) Softing edgeConnector (affected versions not specified) Softing OPC Suite (affected versions not specified) Softing uaGate (affected versions not specified)

Description The issue is related to a NULL pointer dereference vulnerability in the implementation of OPC UA methods in Softing software. This vulnerability can be exploited by a remote attacker to cause a denial-of-service. The estimated number of potentially affected devices worldwide is not available. There is no information about real-world incidents where this issue was exploited. Technical details about exploitation include the NULL pointer dereference vulnerability, which can be triggered by sending specific OPC UA messages.

Recommendations For Softing OPC UA C++ Server SDK, consider disabling the vulnerable OPC UA functionality until a patch is available. For Softing Secure Integration Server, restrict access to the server to minimize the risk of exploitation. For Softing edgeAggregator, avoid using the affected edgeAggregator module in critical operations until the issue is resolved. For Softing edgeConnector, temporarily disable the edgeConnector functionality to prevent potential exploitation. For Softing OPC Suite, restrict access to the suite's OPC UA features to minimize the risk of exploitation. For Softing uaGate, consider disabling the uaGate functionality until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

BDU:2023-02368

CVE-2022-1748

ZDI-22-1153

Affected Products

Softing Opc Suite

Softing Opc Ua C++ Server Sdk

Softing Secure Integration Server

Softing Edgeaggregator

Softing Edgeconnector

Softing Uagate

References · 8

• https://industrial.softing.com/fileadmin/psirt/downloads/syt-2022-7.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-1748 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-22-1153 · Security Note
• https://bdu.fstec.ru/vul/2023-02368 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-1748 · Security Note
• https://t.me/cibsecurity/48302 · Telegram Post
• https://us-cert.gov/ics/advisories/icsa-22-228-04 · Note
• https://cisa.gov/uscert/ics/advisories/icsa-22-228-04 · Note