CVE-2021-40871 Denial of service in n/a

High 7.5 Published 10 Nov 2021 Updated 4 Aug 2024

Remote attackers can cause a denial of service by sending crafted messages to the OPC UA client, leading to a crash due to a type cast error.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2021-40871?

CVE-2021-40871 is a high-severity denial of service vulnerability in n/a, published on 10 Nov 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An issue was discovered in Softing Industrial Automation OPC UA C++ SDK before 5.66. Remote attackers to cause a denial of service (DoS) by sending crafted messages to a OPC/UA client. The client process may crash unexpectedly because of a wrong type cast, and must be restarted.

Weakness: CWE-843

Which versions are affected by CVE-2021-40871?

It affects 4 products.

Products include Softing Datafeed Opc Suite, Softing Opc, Softing Secure Integration Server, Softing Th Scope.

How do I fix CVE-2021-40871?

No fix has been published for CVE-2021-40871 yet. Limit exposure of the affected software until one is available.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2021-40871 being exploited?

There is no known exploitation of CVE-2021-40871 in the wild and no public exploit code.

Sources

Also known as GHSA-jh98-gv77-c9cx.