CVE-2024-10085
highpriority · track · 0EPSS 0.004 · 37 %ileRUUSEPSS · scored 2026-10-27
CWE-770: Allocation of Resources Without Limits or Throttling vulnerability exists that could cause denial of service of the OPC UA communication platform when a large number of OPC UA requests are sent to the platform.
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
A vendor fix is available.
- FixedEcoStruxure OPC UA Server Expertcisa_csaf_ot
Version SV2.01 SP3 of EcoStruxure OPC UA Server Expert includes a fix for this vulnerability and is available for download here: https://www.se.com/ww/en/product-range/66388-ecostruxure-opc-ua-server-expert/#software-and-firmware
https://www.se.com/ww/en/product-range/66388-ecostruxure-opc-ua-server-expert/#software-and-firmware - MitigationEcoStruxure Modicon Communication Servercisa_csaf_ot
Schneider Electric is establishing a remediation plan for all future versions of EcoStruxure Modicon Communication Server that will include a fix for this vulnerability. We will update this document when the remediation is available. Until then, customers should immediately apply the following mitigations to reduce the risk of exploit: * Set the “Security Policy” to Basic256-Sha256 (default value indicated by unchecked “Security Policy” setting) used for secure communication between OPC UA client & server based on OPC UA standard. * Ensure that the “Anonymous user token” setting remains unchecked (unchecked by default) to prevent anonymous authentication. * Set “User authentication” setting (checked by default) used to authenticate & authorize OPC UA client. * Set “X509 user token” setting (checked by default) used to authenticate & authorize OPC UA client. For more details, refer to “EcoStruxure Modicon Server User Guide” chapter “Security Settings”: https://www.se.com/fr/fr/download/document/EIO0000004083/ * Follow workstation, network and site-hardening guidelines in the “Recommended Cybersecurity Best Practices”: https://www.se.com/ww/en/download/document/7EN52-0390/
https://www.se.com/fr/fr/download/document/EIO0000004083/ - MitigationEcoStruxure OPC UA Server Expertcisa_csaf_ot
If customers choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit: * Set the “Security Policy” to Basic256-Sha256 (default value indicated by unchecked “Security Policy” setting) used for secure communication between OPC UA client & server based on OPC UA standard. * Ensure that the “Anonymous user token” setting remains unchecked (unchecked by default) to prevent anonymous authentication. * Set “User authentication” setting (checked by default) used to authenticate & authorize OPC UA client. * Set “X509 user token” setting (checked by default) used to authenticate & authorize OPC UA client. For more details, refer to “EcoStruxure OPC UA Server Expert User Guide” chapter “Security Management”: https://www.se.com/ww/en/download/document/MFR53158/ * Follow workstation, network and site-hardening guidelines in the “Recommended Cybersecurity Best Practices”: https://www.se.com/ww/en/download/document/7EN52-0390/
https://www.se.com/ww/en/download/document/MFR53158/
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 4.6–8.2
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (7)
Products and version ranges known to be affected.
advisories (1)
Vendor and ecosystem advisories describing this.
- ICSA-25-301-01Schneider Electric EcoStruxure2025-10-14icsa · cisa_csaf_otUS
Schneider Electric is aware of a vulnerability in its EcoStruxure OPC UA Server Expert product(s). The [EcoStruxure OPC UA Server Expert product(s)](https://www.se.com/ww/en/product-country-selector/?pageType=product-range&sourceId=66388#overview) is a state-of-the-art OPC UA communication platform linking Modicon industrial equipment and PLCs to the Industrial Internet of Things (IIoT). [EcoStruxure Modicon Communication Server](https://www.se.com/ww/en/download/document/ES_MCS_2.01_SP2/) is a communication platform seamlessly linking Modicon PLCs to Aveva System Platform by using the OPC UA protocol with the help of OPC UA Server. Failure to apply the fix / mitigation provided below may risk denial of service of EcoStruxureTM OPCUA Server Expert, which could result in the loss of real-time process data from Modicon Controller.
also known as (1)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (1) nvd
External citations — patches, advisories, analysis.
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan