Lucene search

[email protected]NVD:CVE-2022-25302

HistoryAug 23, 2022 - 5:15 a.m.

CVE-2022-25302

2022-08-2305:15:07

web.nvd.nist.gov

vulnerability dos package asneg/opcuastack unvalidated data boost::get function opcuanodeidbase.h crafted opc ua message special encoded nodeid

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.001

Percentile

38.4%

JSON

All versions of package asneg/opcuastack are vulnerable to Denial of Service (DoS) due to a missing handler for failed casting when unvalidated data is forwarded to boost::get function in OpcUaNodeIdBase.h. Exploiting this vulnerability is possible when sending a specifically crafted OPC UA message with a special encoded NodeId.

Affected configurations

Nvd

Node

opc_ua_stack_projectopc_ua_stack

VendorProductVersionCPE
opc_ua_stack_projectopc_ua_stack*cpe:2.3:a:opc_ua_stack_project:opc_ua_stack:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
opc_ua_stack_project	opc_ua_stack	*	cpe:2.3:a:opc_ua_stack_project:opc_ua_stack::::::::

References

security.snyk.io/vuln/SNYK-UNMANAGED-ASNEGOPCUASTACK-2988732

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.001

Percentile

38.4%

JSON

Related for NVD:CVE-2022-25302

prion1 cvelist1 cve1