CVE-2023-26150 asyncua Improper Authentication vulnerability
Attackers can access the OPC UA Address Space without authentication or encryption due to missing session checks in the asyncua library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-26150?
CVE-2023-26150 is a medium-severity authentication bypass vulnerability in asyncua, published on 3 Oct 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Versions of the package asyncua before 0.9.96 are vulnerable to Improper Authentication such that it is possible to access Address Space without encryption and authentication. **Note:** This issue is a result of missing checks for services that require an active session.
Weakness: CWE-287
Which versions are affected by CVE-2023-26150?
3 open source packages ship an affected version, including asyncua. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
asyncua PyPI | All versions | 0.9.96 |
asyncua PyPI | All versions | 0.9.96 |
asyncua PyPI | All versions | 0.9.96 |
Products include Freeopcua Opcua-Asyncio.
How do I fix CVE-2023-26150?
Upgrade asyncua to 0.9.96 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2023-26150 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-26150 exists.
Other vulnerabilities in asyncua
Sources
Also known as GHSA-2894-qcqf-g23g, PYSEC-2023-189, UBUNTU-CVE-2023-26150.