BECKHOFF: Null Pointer Dereference vulnerability in products with OPC UA technology
By tricking clients of the mentioned products into contacting malicious OPC UA servers and thereby acting as OPC UA clients, a crash of the component can be provoked.
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2021-45117US | medium6.5 | — | ||
The OPC autogenerated ANSI C stack stubs (in the NodeSets) do not handle all error cases. This can lead to a NULL pointer dereference. | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- VDE-2022-003: BECKHOFF: Null Pointer Dereference vulnerability in products with OPC UA technology - CSAFself
- VDE-2022-003: BECKHOFF: Null Pointer Dereference vulnerability in products with OPC UA technology - HTMLself
- CERT@VDE Security Advisories for Beckhoff Automation GmbH & Co. KGexternal
- Vendor PSIRTexternal
Behebungen (2)
- Mitigation
Have your applications configured to use other than SecurityMode=None for all OPC UA connections. Avoid that these connect to an unknown OPC UA server with SecurityMode=None. In particular, avoid that your applications connect to servers which they discover via mDNS, a Local Discovery Server (LDS), an untrusted Global Discovery Server (GDS) or even trusted GDS using SecurityMode=none. Especially in the latter case an adversary might be able to apply the 'man in the middle' pattern to attack the connection and inject a bad message which triggers the vulnerability.
- Behoben
Please update to a recent version of the affected product.
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan