PT-2025-6085 · Unknown · Opc Ua .Net Standard Stack

Published 2025-02-09 · Updated 2025-03-03 · CVE-2024-42512

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:N/C:C/I:P/A:P

Name of the Vulnerable Software and Affected Versions OPC UA .NET Standard Stack versions prior to 1.5.374.158

Description The issue allows an unauthorized attacker to bypass application authentication when the deprecated Basic128Rsa15 security policy is enabled.

Recommendations For versions prior to 1.5.374.158, update to version 1.5.374.158 or later to resolve the issue. As a temporary workaround, consider disabling the deprecated Basic128Rsa15 security policy until a patch is available. Restrict access to the application when the Basic128Rsa15 security policy is enabled to minimize the risk of exploitation.

Fix

IDOR

Weakness Enumeration

CWE-639

CWE-208

Related Identifiers

BDU:2025-14725

CVE-2024-42512

GHSA-H958-FXGG-G7W3

GHSA-QV5F-57GW-VX3H

Affected Products

Opc Ua .Net Standard Stack

References · 13

• https://files.opcfoundation.org/SecurityBulletins/OPC%20Foundation%20Security%20Bulletin%20CVE-2024-42512.pdf · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-qv5f-57gw-vx3h · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-14725 · Security Note
• https://osv.dev/vulnerability/GHSA-h958-fxgg-g7w3 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-42512 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-42512 · Security Note
• https://github.com/OPCFoundation/UA-.NETStandard · Note
• https://github.com/OPCFoundation/UA-.NETStandard/commit/3543d0292556691f681e39145e2de4526b90487d · Note
• https://github.com/OPCFoundation/UA-.NETStandard/security/advisories/GHSA-h958-fxgg-g7w3 · Note
• https://twitter.com/cybercronai/status/1889808035301691508 · Twitter Post
• https://t.me/cvedetector/17599 · Telegram Post
• https://twitter.com/CVEnew/status/1889022268573138982 · Twitter Post
• https://twitter.com/cracbot/status/1890355508332425528 · Twitter Post