CVE-2023-32787
Prosys OPC UA Simulation Server OpenSecureChannel Resource Exhaustion Denial-of-Service Vulnerability
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
The OPC UA Legacy Java Stack before 6f176f2 enables an attacker to block OPC UA server applications via uncontrolled resource consumption so that they can no longer serve client applications.
El OPC UA Legacy Java Stack anterior a 6f176f2 permite a un atacante bloquear aplicaciones del servidor OPC UA mediante el consumo incontrolado de recursos para que ya no puedan servir aplicaciones cliente.
This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Prosys OPC UA Simulation Server. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the handling of OpenSecureChannel messages. By sending a large number of requests, an attacker can consume all available resources on the server. An attacker can leverage this vulnerability to create a denial-of-service condition on the system.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2023-05-15 CVE Reserved
- 2023-05-15 CVE Published
- 2024-06-16 EPSS Updated
- 2024-08-02 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-400: Uncontrolled Resource Consumption
CAPEC
References (3)
URL | Tag | Source |
---|---|---|
https://github.com/OPCFoundation/UA-Java-Legacy | Product |
URL | Date | SRC |
---|
URL | Date | SRC |
---|
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Opcfoundation Search vendor "Opcfoundation" | Ua Java Legacy Search vendor "Opcfoundation" for product "Ua Java Legacy" | < 2023-04-28 Search vendor "Opcfoundation" for product "Ua Java Legacy" and version " < 2023-04-28" | - |
Affected
| ||||||
Prosysopc Search vendor "Prosysopc" | Ua Historian Search vendor "Prosysopc" for product "Ua Historian" | < 1.2.0 Search vendor "Prosysopc" for product "Ua Historian" and version " < 1.2.0" | - |
Affected
| ||||||
Prosysopc Search vendor "Prosysopc" | Ua Modbus Server Search vendor "Prosysopc" for product "Ua Modbus Server" | < 1.4.20 Search vendor "Prosysopc" for product "Ua Modbus Server" and version " < 1.4.20" | - |
Affected
| ||||||
Prosysopc Search vendor "Prosysopc" | Ua Simulation Server Search vendor "Prosysopc" for product "Ua Simulation Server" | < 5.4.2 Search vendor "Prosysopc" for product "Ua Simulation Server" and version " < 5.4.2" | - |
Affected
|