Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.6

OPC UA .NET Standard Stack: Unauthenticated Access with Basic128Rsa15

CVE-2024-42512 · published 1 year ago
Summary

A security issue in the OPC UA .NET Standard Stack allows an attacker to bypass authentication if a specific security setting is enabled. This could potentially allow unauthorized access to the system. Users should update to the latest version of the OPC UA .NET Standard Stack to address this issue.

What to do
  • Update opc foundation opcfoundation.netstandard.opc.ua.core to version 1.5.374.158.
  • Update opcfoundation ua_.net_standard_stack to version 1.5.374.158 or later.
Affected software
Ecosystem VendorProductAffected versions
nuget opc foundation opcfoundation.netstandard.opc.ua.core < 1.5.374.158
Fix: upgrade to 1.5.374.158
– opcfoundation ua_.net_standard_stack < 1.5.374.158
cpe:2.3:a:opcfoundation:ua_.net_standard_stack:*:*:*:*:*:*:*:*
Original advisory text
Vulnerability in the OPC UA .NET Standard Stack before 1.5.374.158 allows an unauthorized attacker to bypass application authentication when the deprecated Basic128Rsa15 security policy is enabled.
Vulnerability in the OPC UA .NET Standard Stack before 1.5.374.158 allows an unauthorized attacker to bypass application authentication when the deprecated Basic128Rsa15 security policy is enabled.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
8.6 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-208Observable Timing Discrepancy
CWE-639Authorization Bypass Through User-Controlled Key
Timeline
Published10 Feb 2025
Updated4 Nov 2026
First seen6 Mar 2026
Sources
GHSA-h958-fxgg-g7w3 · GHSA
CVE-2024-42512 · NVD
CVE-2024-42512 · OSV
CVE-2024-42512 · MITRE
Track software like this
Free during beta