CVE-2020-29457 Improper Certificate Validation in OPCFoundation.NetStandard.Opc.Ua.Core

What is CVE-2020-29457?

CVE-2020-29457 is a medium-severity authentication bypass vulnerability in n/a, published on 16 Feb 2021. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A Privilege Elevation vulnerability in OPC UA .NET Standard Stack 1.4.363.107 could allow a rogue application to establish a secure connection.

Weakness: CWE-295

Which versions are affected by CVE-2020-29457?

2 open source packages ship an affected version, including OPCFoundation.NetStandard.Opc.Ua.Core. It affects 1 product.

Products include Opcfoundation Ua-.Netstandard.

How do I fix CVE-2020-29457?

Upgrade OPCFoundation.NetStandard.Opc.Ua.Core to 1.4.365.10 or later.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2020-29457 being exploited?

There is no known exploitation of CVE-2020-29457 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2023-27321 OPC Foundation UA .NET Standard ConditionRefresh Resource Exhaustion Denial-of-Service Vulnerability High 7.5
• CVE-2023-31048 Exposure of Sensitive Information in OPC UA .NET Standard Reference Server Medium 5.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-mjww-934m-h4jw.