CVE-2021-40872

HIGH

Softing Industrial Automation uaToolkit Embedded <1.40 - DoS

Title source: llm

Description

An issue was discovered in Softing Industrial Automation uaToolkit Embedded before 1.40. Remote attackers to cause a denial of service (DoS) or login as an anonymous user (bypassing security checks) by sending crafted messages to a OPC/UA server. The server process may crash unexpectedly because of an invalid type cast, and must be restarted.

References (2)

Core 2

Core References

Vendor Advisory x_refsource_misc

https://industrial.softing.com/

Vendor Advisory x_refsource_misc

https://industrial.softing.com/fileadmin/sof-files/pdf/ia/support/Security_Bulletin_CVE-2021-40872.pdf

Scores

CVSS v3 7.5

EPSS 0.0066

EPSS Percentile 71.3%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Details

CWE

CWE-843

Status published

Products (2)

softing/smartlink_hw-dp < 1.10

softing/uatoolkit_embedded < 1.40

Published Nov 10, 2021

Tracked Since Feb 18, 2026