CVE-2024-33862 OPCFoundation.NetStandard.Opc.Ua.Core buffer-management vulnerability
Remote attackers can exhaust memory resources via excessive messages, causing denial of service in applications using the OPC UA .NET Core library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-33862?
CVE-2024-33862 is a high-severity denial of service vulnerability in n/a, published on 5 Jul 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A buffer-management vulnerability in OPC Foundation OPCFoundation.NetStandard.Opc.Ua.Core before 1.05.374.54 could allow remote attackers to exhaust memory resources. It is triggered when the system receives an excessive number of messages from a remote source. This could potentially lead to a denial of service (DoS) condition, disrupting the normal operation of the system.
Weakness: CWE-770
Which versions are affected by CVE-2024-33862?
2 open source packages ship an affected version, including OPCFoundation.NetStandard.Opc.Ua.Core.
| Package | Affected | Fixed in |
|---|---|---|
OPCFoundation.NetStandard.Opc.Ua.Core NuGet | All versions | 1.5.374.54 |
OPCFoundation.NetStandard.Opc.Ua.Core NuGet | All versions | 1.5.374.54 |
How do I fix CVE-2024-33862?
Upgrade OPCFoundation.NetStandard.Opc.Ua.Core to 1.5.374.54 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2024-33862 being exploited?
There is no known exploitation of CVE-2024-33862 in the wild and no public exploit code.
Sources
Also known as GHSA-4q2p-hwmr-qcxc.