Description
This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of OPC Foundation UA .NET Standard 1.04.358.30. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of sessions. The issue results from the lack of proper locking when performing operations on an object. An attacker can leverage this vulnerability to create a denial-of-service condition against the application. Was ZDI-CAN-10295.
References (2)
Core 2
Core References
Third Party Advisory, VDB Entry x_refsource_misc
https://www.zerodayinitiative.com/advisories/ZDI-20-536/
Vendor Advisory x_refsource_misc
https://opcfoundation.org/SecurityBulletins/OPC%20Foundation%20Security%20Bulletin%20CVE-2020-8867.pdf
Scores
CVSS v3
7.5
EPSS
0.0172
EPSS Percentile
82.6%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Details
CWE
CWE-367
CWE-613
Status
published
Products (2)
nuget/OPCFoundation.NetStandard.Opc.Ua
0 - 1.4.359.31NuGet
opcfoundation/unified_architecture_.net-standard
< 1.04.358.30
Published
Apr 22, 2020
Tracked Since
Feb 18, 2026