CVE-2021-27434 Denial of service in OPC UA Products Built with the .NET Framework 4.5, 4.0, and 3.5
An attacker can trigger a stack overflow via uncontrolled recursion in the Unified Automation .NET OPC UA SDK, causing a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-27434?
CVE-2021-27434 is a high-severity denial of service vulnerability in OPC UA Products Built with the .NET Framework 4.5, 4.0, and 3.5, published on 20 May 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Products with Unified Automation .NET based OPC UA Client/Server SDK Bundle: Versions V3.0.7 and prior (.NET 4.5, 4.0, and 3.5 Framework versions only) are vulnerable to an uncontrolled recursion, which may allow an attacker to trigger a stack overflow.
Which versions are affected by CVE-2021-27434?
It affects 1 product.
Products include Unified-Automation .Net Based Opc Ua Client\/Server Sdk.
How do I fix CVE-2021-27434?
No fix has been published for CVE-2021-27434 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2021-27434 being exploited?
There is no known exploitation of CVE-2021-27434 in the wild and no public exploit code.
Sources
Also known as GHSA-43g9-fmq9-jjpm.