CVE-2023-27336

2024-05-0302:15:10

CWE-476

[email protected]

web.nvd.nist.gov

cve-2023-27336

softing

edgeconnector

siemens

opc ua

null pointer

denial-of-service

vulnerability

remote attackers

authentication

opc client certificates

zdi-can-20508

nvd

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

0.001 Low

EPSS

Percentile

29.0%

JSON

Softing edgeConnector Siemens OPC UA Server Null Pointer Dereference Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Softing edgeConnector Siemens. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the handling of OPC client certificates. The issue results from dereferencing a NULL pointer. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-20508.

Affected configurations

Vulners

Node

softingedgeconnectorRange≤3.40

CNA Affected

[
  {
    "vendor": "Softing",
    "product": "edgeConnector Siemens",
    "versions": [
      {
        "version": "3.40",
        "status": "affected"
      }
    ],
    "defaultStatus": "unknown"
  }
]