CVE-2024-45526 Security Update for the OPC UA .NET Standard Stack
Remote attackers can degrade server performance by sending requests with invalid credentials, affecting OPC UA .NET Standard library users.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-45526?
CVE-2024-45526 is a medium-severity denial of service vulnerability in n/a, published on 22 Oct 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in OPC Foundation OPCFoundation/UA-.NETStandard through 1.5.374.78. A remote attacker can send requests with invalid credentials and cause the server performance to degrade gradually.
Weakness: CWE-770
Which versions are affected by CVE-2024-45526?
4 open source packages ship an affected version, including OPCFoundation.NetStandard.Opc.Ua and OPCFoundation.NetStandard.Opc.Ua.Core.
| Package | Affected | Fixed in |
|---|---|---|
OPCFoundation.NetStandard.Opc.Ua NuGet | All versions | 1.5.374.118 |
OPCFoundation.NetStandard.Opc.Ua NuGet | All versions | 1.5.374.118 |
OPCFoundation.NetStandard.Opc.Ua.Core NuGet | All versions | 1.5.374.118 |
OPCFoundation.NetStandard.Opc.Ua.Core NuGet | All versions | 1.5.374.118 |
How do I fix CVE-2024-45526?
Upgrade OPCFoundation.NetStandard.Opc.Ua to 1.5.374.118 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2024-45526 being exploited?
There is no known exploitation of CVE-2024-45526 in the wild and no public exploit code.
Sources
Also known as GHSA-7vfh-cqpc-4267.