Lucene search

K
cveSnykCVE-2022-25302
HistoryAug 23, 2022 - 5:15 a.m.

CVE-2022-25302

2022-08-2305:15:07
snyk
web.nvd.nist.gov
36
2
cve-2022-25302
package vulnerability
denial of service
opc ua
nvd

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.001

Percentile

38.4%

All versions of package asneg/opcuastack are vulnerable to Denial of Service (DoS) due to a missing handler for failed casting when unvalidated data is forwarded to boost::get function in OpcUaNodeIdBase.h. Exploiting this vulnerability is possible when sending a specifically crafted OPC UA message with a special encoded NodeId.

Affected configurations

Nvd
Node
opc_ua_stack_projectopc_ua_stack
VendorProductVersionCPE
opc_ua_stack_projectopc_ua_stack*cpe:2.3:a:opc_ua_stack_project:opc_ua_stack:*:*:*:*:*:*:*:*

CNA Affected

[
  {
    "product": "ASNeG/OpcUaStack",
    "vendor": "n/a",
    "versions": [
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

Social References

More

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.001

Percentile

38.4%

Related for CVE-2022-25302