ICSA-21-133-04

OPC UA Products Built with the .NET Framework 4.5, 4.0, and 3.5

Advisory ansehen veröffentlicht 2021-05-13

Successful exploitation of this vulnerability could allow an unauthenticated attacker to read any file on the file system.

beschreibt (1)

Zugehörige CVEs.

ID	Schweregrad	EPSS	ausnutzbar	veröffentlicht
CVE-2021-27434US	high7.5	1.74% (78th)	—	2021-05-20
Products with Unified Automation .NET based OPC UA Client/Server SDK Bundle: Versions V3.0.7 and prior (.NET 4.5, 4.0, and 3.5 Framework versions only) are vulnerable to an uncontr…

Referenzen

Externe Belege — Patches, Meldungen, Analysen.

ICS Advisory ICSA-21-133-04 JSONself
Recommended Practicesexternal
Recommended Practicesexternal
Recommended Practicesexternal
ICS Advisory ICSA-21-133-04 Web Versionself

Behebungen (1)

MitigationUnified Automation .NET based OPC UA Client/Server SDK Bundle
Unified Automation has released software (login required) to address the .NET Framework vulnerabilities. OPC Foundation recommends users deploying OPC UA .NET products built against the .NET 4.5, 4.0, and 3.5 Frameworks should contact the product supplier to determine if an update is needed. Users should also consider upgrading to a version of the product using .NET 4.5.2 Framework or later. It is recommended users avoid using the end-of-life version of the .NET Framework due to the risk of unpatched vulnerabilities.
https://www.unified-automation.com/downloads/opc-ua-development.html

scry

Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan