PT-2025-6086 · Unknown · Opc Ua .Net Standard Stack

Published 2025-02-10 · Updated 2025-10-02 · CVE-2024-42513

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions OPC UA .NET Standard Stack versions prior to 1.5.374.158

Description A vulnerability in the OPC UA .NET Standard Stack allows an unauthorized attacker to bypass application authentication when using HTTPS endpoints.

Recommendations For versions prior to 1.5.374.158, update to version 1.5.374.158 or later to resolve the issue. As a temporary workaround, consider restricting access to HTTPS endpoints until a patch is applied.

Fix

Authentication Bypass by Spoofing

Weakness Enumeration

CWE-305

CWE-290

Related Identifiers

CVE-2024-42513

GHSA-4RCC-7PG7-F57F

GHSA-7WWR-H8CM-9JF7

Affected Products

Opc Ua .Net Standard Stack

References · 12

• https://osv.dev/vulnerability/GHSA-7wwr-h8cm-9jf7 · Vendor Advisory
• https://files.opcfoundation.org/SecurityBulletins/OPC%20Foundation%20Security%20Bulletin%20CVE-2024-42513.pdf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-42513 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4rcc-7pg7-f57f · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-42513 · Security Note
• https://github.com/OPCFoundation/UA-.NETStandard · Note
• https://github.com/OPCFoundation/UA-.NETStandard/tree/1.5.374.158 · Note
• https://github.com/OPCFoundation/UA-.NETStandard/security/advisories/GHSA-4rcc-7pg7-f57f · Note
• https://t.me/cvedetector/17592 · Telegram Post
• https://twitter.com/cybercronai/status/1889812126224576664 · Twitter Post
• https://twitter.com/CVEnew/status/1889022269336461502 · Twitter Post
• https://t.me/cveNotify/137229 · Telegram Post