PT-2023-20529 · Asyncua · Asyncua

Tran Van Arthur · Published 2023-10-02 · Updated 2023-10-04 · CVE-2023-26150

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions asyncua versions prior to 0.9.96

Description The issue is related to Improper Authentication, allowing access to Address Space without encryption and authentication. This is due to missing checks for services that require an active session.

Recommendations For versions prior to 0.9.96, update to version 0.9.96 or later to resolve the issue. As a temporary workaround, consider implementing additional authentication checks for services that require an active session to minimize the risk of exploitation.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2023-26150

GHSA-2894-QCQF-G23G

PYSEC-2023-189

Affected Products

Asyncua

References · 18

• 🔥 https://github.com/FreeOpcUa/opcua-asyncio/issues/1014 · Exploit
• 🔥 https://gist.github.com/artfire52/84f7279a4119d6f90381ac49d7121121 · Exploit
• 🔥 https://security.snyk.io/vuln/SNYK-PYTHON-ASYNCUA-5673435 · Exploit
• https://github.com/FreeOpcUa/opcua-asyncio/commit/2be7ce80df05de8d6c6ae1ebce6fa2bb7147844a · Patch
• https://github.com/FreeOpcUa/opcua-asyncio/commit/b4106dfd5037423c9d1810b48a97296b59cde513 · Patch
• https://github.com/FreeOpcUa/opcua-asyncio/pull/1015 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-26150 · Security Note
• https://osv.dev/vulnerability/CVE-2023-26150 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-26150 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-2894-qcqf-g23g · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-26150 · Security Note
• https://osv.dev/vulnerability/PYSEC-2023-189 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-26150 · Vendor Advisory
• https://github.com/FreeOpcUa/opcua-asyncio/releases/tag/v0.9.96 · Note
• https://github.com/FreeOpcUa/opcua-asyncio · Note