Read the docs
TI-2026-06048 Aliases CVE-2026-6899GHSA-j893-vcpr-rgfc

Improper Check for Certificate Revocation in S2OPC

Priority LOW 24CWE-299Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Check for certificate revocation only considers the first matching CRL and ignores other valid CRLs of the same CA in the CycloneCrypto cryptographic wrapper of S2OPC library. It might allow connection between an OPC UA client and server using a revoked certificate.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00108 1st percentileScored 2026-11-07
Fix Fixed S2OPC (Systerel): 1.7.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SysterelS2OPC1.5.0 to before 1.7.31.7.3Patch availableCNA
  • S2OPC VendorSysterel Affected 1.5.0 to before 1.7.3 Fixed in 1.7.3 Patch available CNA

Remediation

  • Fix · CNA S2OPC (Systerel) Fixed in 1.7.3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-6899
  2. 2026-10-03 Alias added: GHSA-j893-vcpr-rgfc

References

Other 1

  • TI-2026-54290 Systerel S2OPC AddNodes Service sopc_node_mgt_helper_internal.c out-of-bounds CVSS 4.0MEDIUM 6.3
  • TI-2026-61689 S2OPC through 1.7.3 NULL Pointer Dereference in alloc_notification_message_items() CVSS 4.0MEDIUM 6.0
  • TI-2026-56960 Systerel S2OPC subscription_mgr.c use after free CVSS 4.0MEDIUM 5.3
  • TI-2026-56959 Systerel S2OPC String Array Range Writing sopc_builtintypes.c set_range_matrix_on_string_array out-of-bounds CVSS 4.0MEDIUM 5.3
  • TI-2026-15394 Systerel S2OPC DeleteMonitoredItemsRequest state_machine.c out-of-bounds CVSS 4.0MEDIUM 4.8
  • TI-2026-08554 Improper Certificate Validation in S2OPC CVSS 3.1HIGH 7.3
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences