Vulnerability in the OPC UA .NET Standard Stack before 1.5.374.158 allows an unauthorized…
Priority LOW 25CWE-305Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub. Impact type from CWE-290.
Summary
Vulnerability in the OPC UA .NET Standard Stack before 1.5.374.158 allows an unauthorized attacker to bypass application authentication when using HTTPS endpoints.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00577 47th percentileScored 2026-11-07
Fix Fixed OPCFoundation.NetStandard.Opc.Ua.Bindings.Https (NuGet): 1.5.374.158
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | OPCFoundation.NetStandard.Opc.Ua.Bindings.Https (NuGet) | before 1.5.374.158 | 1.5.374.158 | Patch available | GHSA-4rcc-7pg7-f57f |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- OPCFoundation.NetStandard.Opc.Ua.Bindings.Https (NuGet) Vendor— Affected before 1.5.374.158 Fixed in 1.5.374.158 Patch available GHSA-4rcc-7pg7-f57f
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:opcfoundation:ua_.net_standard_stack:*:*:*:*:*:*:*:* | before 1.5.374.158 | Vulnerable | OPC Foundation |
- cpe:2.3:a:opcfoundation:ua_.net_standard_stack:*:*:*:*:*:*:*:* Versions before 1.5.374.158 Vulnerable ·OPC Foundation
Remediation
- Fix · GHSA-4rcc-7pg7-f57f OPCFoundation.NetStandard.Opc.Ua.Bindings.Https (NuGet) Fixed in 1.5.374.158 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2024-42513
- 2026-10-03 Alias added: GHSA-4rcc-7pg7-f57f
References
Advisory 2
More OPC Foundation Ua .net Standard Stack vulnerabilities
- TI-2024-28477 Vulnerability in the OPC UA .NET Standard Stack before 1.5.374.158 allows an unauthorized… CVSS 3.1HIGH 8.6
- TI-2022-12221 OPC UA .NET Standard Stack 1.04.368 allows a remote attacker to cause a server to crash… CVSS 3.1HIGH 7.5
- TI-2021-08921 Uncontrolled recursion in OPC Foundation OPC UA .NET Standard and OPC UA .NET Legacy CVSS 3.1HIGH 7.5
- TI-2022-14921 OPC UA .NET Standard Reference Server 1.04.368 allows a remote attacker to cause the… CVSS 3.1HIGH 7.5
- TI-2022-12223 OPC UA .NET Standard Stack 1.04.368 allows a remote attacker to exhaust the memory… CVSS 3.1HIGH 7.5
- TI-2022-12222 OPC UA .NET Standard Stack allows a remote attacker to bypass the application… CVSS 3.1HIGH 7.5
Sources
- CVE-2024-42513 · CVE Program
- CVE-2024-42513 · NVD
- FIRST EPSS
- GHSA-4rcc-7pg7-f57f · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences