Insufficiently protected credentials in Prosys OPC UA Simulation Server
Priority LOW 35CWE-522Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-522.
Summary
Prosys OPC UA Simulation Server version prior to v5.3.0-64 and UA Modbus Server versions 1.4.18-5 and prior do not sufficiently protect credentials, which could allow an attacker to obtain user credentials and gain access to system data.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00431 37th percentileScored 2026-11-07
Fix Fixed UA Simulation Server (Prosys OPC): 5.3.0-64
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Prosys OPC | UA Simulation Server | before 5.3.0-64 | 5.3.0-64 | Patch available | CNA |
| Prosys OPC | UA Modbus Server | up to 1.4.18-5 | — | No fix listed | CNA |
- UA Simulation Server VendorProsys OPC Affected before 5.3.0-64 Fixed in 5.3.0-64 Patch available CNA
- UA Modbus Server VendorProsys OPC Affected up to 1.4.18-5 Fixed in — No fix listed CNA
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:prosysopc:ua_modbus_server:*:*:*:*:*:*:*:* | before 1.4.20 | Vulnerable | Prosys OPC |
| cpe:2.3:a:prosysopc:ua_simulation_server:*:*:*:*:*:*:*:* | before 5.4.0 | Vulnerable | Prosys OPC |
- cpe:2.3:a:prosysopc:ua_modbus_server:*:*:*:*:*:*:*:* Versions before 1.4.20 Vulnerable ·Prosys OPC
- cpe:2.3:a:prosysopc:ua_simulation_server:*:*:*:*:*:*:*:* Versions before 5.4.0 Vulnerable ·Prosys OPC
Remediation
- Fix · CNA UA Simulation Server (Prosys OPC) Fixed in 5.3.0-64
Timeline
- 2026-10-02 Threatist record created from CVE-2022-2967
- 2026-10-03 Alias added: GHSA-cc9p-869w-hxh2
References
More Prosys OPC Ua Modbus Server vulnerabilities
- TI-2023-16039 The OPC UA Legacy Java Stack before 6f176f2 enables an attacker to block OPC UA server… CVSS 3.1HIGH 7.5
Sources
- CVE-2022-2967 · CVE Program
- CVE-2022-2967 · NVD
- FIRST EPSS
- GHSA-cc9p-869w-hxh2 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences