Vulnerability in the OPC UA .NET Standard Stack before 1.5.374.158 allows an unauthorized…
Priority MEDIUM 44CWE-208Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure, Security bypass
- Confidentiality · integrity · availability
- High · Low · Low
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub. Impact type from CWE-208 and CWE-639.
Summary
Vulnerability in the OPC UA .NET Standard Stack before 1.5.374.158 allows an unauthorized attacker to bypass application authentication when the deprecated Basic128Rsa15 security policy is enabled.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00594 48th percentileScored 2026-11-07
Fix Fixed OPCFoundation.NetStandard.Opc.Ua.Core (NuGet): 1.5.374.158
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | OPCFoundation.NetStandard.Opc.Ua.Core (NuGet) | before 1.5.374.158 | 1.5.374.158 | Patch available | GHSA-h958-fxgg-g7w3 |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- OPCFoundation.NetStandard.Opc.Ua.Core (NuGet) Vendor— Affected before 1.5.374.158 Fixed in 1.5.374.158 Patch available GHSA-h958-fxgg-g7w3
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:opcfoundation:ua_.net_standard_stack:*:*:*:*:*:*:*:* | before 1.5.374.158 | Vulnerable | OPC Foundation |
- cpe:2.3:a:opcfoundation:ua_.net_standard_stack:*:*:*:*:*:*:*:* Versions before 1.5.374.158 Vulnerable ·OPC Foundation
Remediation
- Fix · GHSA-h958-fxgg-g7w3 OPCFoundation.NetStandard.Opc.Ua.Core (NuGet) Fixed in 1.5.374.158 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2024-42512
- 2026-10-03 Alias added: GHSA-h958-fxgg-g7w3
References
Advisory 2
More OPC Foundation Ua .net Standard Stack vulnerabilities
- TI-2022-12221 OPC UA .NET Standard Stack 1.04.368 allows a remote attacker to cause a server to crash… CVSS 3.1HIGH 7.5
- TI-2021-08921 Uncontrolled recursion in OPC Foundation OPC UA .NET Standard and OPC UA .NET Legacy CVSS 3.1HIGH 7.5
- TI-2022-14921 OPC UA .NET Standard Reference Server 1.04.368 allows a remote attacker to cause the… CVSS 3.1HIGH 7.5
- TI-2022-12223 OPC UA .NET Standard Stack 1.04.368 allows a remote attacker to exhaust the memory… CVSS 3.1HIGH 7.5
- TI-2022-12222 OPC UA .NET Standard Stack allows a remote attacker to bypass the application… CVSS 3.1HIGH 7.5
- TI-2022-12220 OPC UA .NET Standard Stack 1.04.368 allows remote attacker to cause a crash via a crafted… CVSS 3.1HIGH 7.5
Sources
- CVE-2024-42512 · CVE Program
- CVE-2024-42512 · NVD
- FIRST EPSS
- GHSA-h958-fxgg-g7w3 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences