CVE-2023-31048

Vulnerability

Overview CVE-2023-31048 is an information disclosure vulnerability in the OPC UA .NET Standard Reference Server. The server includes sensitive information in error messages that are visible to remote clients. This issue exists in versions prior to 1.4.371.86. [1][3]

Attack

Vector An attacker can remotely trigger error conditions that cause the server to return error messages containing confidential data. No special privileges are required beyond the ability to connect to the OPC UA server. The vulnerability is exposed through the server's service calls, where error handling does not filter out sensitive details. [3][4]

Impact

Successful exploitation allows a remote attacker to obtain sensitive information from the server's error responses. This could include configuration details, internal state data, or other secrets that could aid further attacks against the system. The exact type of information exposed is not specified but is classified as sensitive. [1][2]

Mitigation

The vulnerability is fixed in version 1.4.371.86 of the OPC UA .NET Standard Reference Server. Users should update to this release or later. The fix was included in the "OPC UA 1.04 Maintenance Update" rollup. No workarounds are mentioned, so applying the update is recommended. [1][3]