CVE-2023-27321 OPC Foundation UA .NET Standard ConditionRefresh Resource Exhaustion Denial-of-Service Vulnerability

What is CVE-2023-27321?

CVE-2023-27321 is a high-severity denial of service vulnerability in OPC Foundation UA .NET Standard, published on 7 May 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

OPC Foundation UA .NET Standard ConditionRefresh Resource Exhaustion Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of OPC Foundation UA .NET Standard. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the handling of OPC UA ConditionRefresh requests. By sending a large number of requests, an attacker can consume all available resources on the server. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-20505.

Weakness: CWE-400

Which versions are affected by CVE-2023-27321?

2 open source packages ship an affected version, including OPCFoundation.NetStandard.Opc.Ua.Server. It affects 1 product.

Products include Opcfoundation Ua-.Netstandard.

How do I fix CVE-2023-27321?

Upgrade OPCFoundation.NetStandard.Opc.Ua.Server to 1.4.371.86 or later.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2023-27321 being exploited?

There is no known exploitation of CVE-2023-27321 in the wild and no public exploit code.

Other vulnerabilities in OPC Foundation UA .NET Standard

• CVE-2023-31048 Exposure of Sensitive Information in OPC UA .NET Standard Reference Server Medium 5.3
• CVE-2020-29457 Improper Certificate Validation in OPCFoundation.NetStandard.Opc.Ua.Core Medium 4.4

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-vpf7-r2fv-75m9.