CVE-2022-29865 Incorrect Implementation of Authentication Algorithm in OPCFoundation.NetStandard.Opc.Ua.Core

What is CVE-2022-29865?

CVE-2022-29865 is a high-severity authentication bypass vulnerability in n/a, published on 16 Jun 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

OPC UA .NET Standard Stack allows a remote attacker to bypass the application authentication check via crafted fake credentials.

Weakness: CWE-287

Which versions are affected by CVE-2022-29865?

2 open source packages ship an affected version, including OPCFoundation.NetStandard.Opc.Ua.Core. It affects 1 product.

Products include Opcfoundation Ua .Net Standard Stack.

How do I fix CVE-2022-29865?

Upgrade OPCFoundation.NetStandard.Opc.Ua.Core to 1.4.368.58 or later.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2022-29865 being exploited?

There is no known exploitation of CVE-2022-29865 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2024-42512 Security Update for the OPC UA .NET Standard Stack High 8.6
• CVE-2022-33916 Exposure of Sensitive Information in OPCFoundation.NetStandard.Opc.Ua.Server High 7.5
• CVE-2022-29862 Security Update for the OPC UA .NET Standard Stack High 7.5
• CVE-2022-29863 Memory Allocation with Excessive Size Value in OPCFoundation.NetStandard.Opc.Ua.Core High 7.5
• CVE-2022-29864 Uncontrolled Resource Consumption in OPCFoundation.NetStandard.Opc.Ua.Core High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-fvxf-r9fw-49pc.