Opc Ua C\+\+ Software Development Kit
by Softx
CVEs (16)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2022-2336 | Cri | 0.64 | 9.8 | 0.01 | Aug 17, 2022 | Softing Secure Integration Server, edgeConnector, and edgeAggregator software ships with the default administrator credentials as `admin` and password as `admin`. This allows Softing to log in to the server directly to perform administrative functions. Upon installation or upon… | ||
| CVE-2022-2334 | Hig | 0.51 | 7.2 | 0.12 | Aug 17, 2022 | The application searches for a library dll that is not found. If an attacker can place a dll with this name, then the attacker can leverage it to execute arbitrary code on the targeted Softing Secure Integration Server V1.22. | ||
| CVE-2022-1373 | Hig | 0.51 | 7.2 | 0.13 | Aug 17, 2022 | The “restore configuration” feature of Softing Secure Integration Server V1.22 is vulnerable to a directory traversal vulnerability when processing zip files. An attacker can craft a zip file to load an arbitrary dll and execute code. Using the "restore configuration"… | ||
| CVE-2023-27334 | Hig | 0.49 | 7.5 | 0.01 | May 3, 2024 | Softing edgeConnector Siemens ConditionRefresh Resource Exhaustion Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Softing edgeConnector Siemens. Authentication is not required to… | ||
| CVE-2023-41151 | Hig | 0.49 | 7.5 | 0.01 | Dec 14, 2023 | An uncaught exception issue discovered in Softing OPC UA C++ SDK before 6.30 for Windows operating system may cause the application to crash when the server wants to send an error packet, while socket is blocked on writing. | ||
| CVE-2022-39823 | Hig | 0.49 | 7.5 | 0.01 | Oct 20, 2022 | An issue was discovered in Softing OPC UA C++ SDK 5.66 through 6.x before 6.10. An OPC/UA browse request exceeding the server limit on continuation points may cause a use-after-free error | ||
| CVE-2022-37453 | Hig | 0.49 | 7.5 | 0.01 | Oct 20, 2022 | An issue was discovered in Softing OPC UA C++ SDK before 6.10. A buffer overflow or an excess allocation happens due to unchecked array and matrix bounds in structure data types. | ||
| CVE-2022-2547 | Hig | 0.49 | 7.5 | 0.01 | Aug 17, 2022 | A crafted HTTP packet without a content-type header can create a denial-of-service condition in Softing Secure Integration Server V1.22. | ||
| CVE-2022-2337 | Hig | 0.49 | 7.5 | 0.01 | Aug 17, 2022 | A crafted HTTP packet with a missing HTTP URI can create a denial-of-service condition in Softing Secure Integration Server V1.22. | ||
| CVE-2022-2335 | Hig | 0.49 | 7.5 | 0.02 | Aug 17, 2022 | A crafted HTTP packet with a -1 content-length header can create a denial-of-service condition in Softing Secure Integration Server V1.22. | ||
| CVE-2022-1748 | Hig | 0.49 | 7.5 | 0.01 | Aug 17, 2022 | Softing OPC UA C++ Server SDK, Secure Integration Server, edgeConnector, edgeAggregator, OPC Suite, and uaGate are affected by a NULL pointer dereference vulnerability. | ||
| CVE-2022-1069 | Hig | 0.49 | 7.5 | 0.02 | Aug 17, 2022 | A crafted HTTP packet with a large content-length header can create a denial-of-service condition in Softing Secure Integration Server V1.22. | ||
| CVE-2021-32994 | Hig | 0.49 | 7.5 | 0.02 | Apr 4, 2022 | Softing OPC UA C++ SDK (Software Development Kit) versions from 5.59 to 5.64 exported library functions don't properly validate received extension objects, which may allow an attacker to crash the software by sending a variety of specially crafted packets to access several… | ||
| CVE-2021-42577 | Hig | 0.49 | 7.5 | 0.01 | Mar 11, 2022 | An issue was discovered in Softing OPC UA C++ SDK before 5.70. A malformed OPC/UA message abort packet makes the client crash with a NULL pointer dereference. | ||
| CVE-2021-42262 | Med | 0.42 | 6.5 | 0.01 | Mar 11, 2022 | An issue was discovered in Softing OPC UA C++ SDK before 5.70. An invalid XML element in the type dictionary makes the OPC/UA client crash due to an out-of-memory condition. | ||
| CVE-2022-2338 | Med | 0.37 | 5.7 | 0.00 | Aug 17, 2022 | Softing Secure Integration Server V1.22 is vulnerable to authentication bypass via a machine-in-the-middle attack. The default the administration interface is accessible via plaintext HTTP protocol, facilitating the attack. The HTTP request may contain the session cookie in the… |
- risk 0.64cvss 9.8epss 0.01
Softing Secure Integration Server, edgeConnector, and edgeAggregator software ships with the default administrator credentials as `admin` and password as `admin`. This allows Softing to log in to the server directly to perform administrative functions. Upon installation or upon…
- risk 0.51cvss 7.2epss 0.12
The application searches for a library dll that is not found. If an attacker can place a dll with this name, then the attacker can leverage it to execute arbitrary code on the targeted Softing Secure Integration Server V1.22.
- risk 0.51cvss 7.2epss 0.13
The “restore configuration” feature of Softing Secure Integration Server V1.22 is vulnerable to a directory traversal vulnerability when processing zip files. An attacker can craft a zip file to load an arbitrary dll and execute code. Using the "restore configuration"…
- risk 0.49cvss 7.5epss 0.01
Softing edgeConnector Siemens ConditionRefresh Resource Exhaustion Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Softing edgeConnector Siemens. Authentication is not required to…
- risk 0.49cvss 7.5epss 0.01
An uncaught exception issue discovered in Softing OPC UA C++ SDK before 6.30 for Windows operating system may cause the application to crash when the server wants to send an error packet, while socket is blocked on writing.
- risk 0.49cvss 7.5epss 0.01
An issue was discovered in Softing OPC UA C++ SDK 5.66 through 6.x before 6.10. An OPC/UA browse request exceeding the server limit on continuation points may cause a use-after-free error
- risk 0.49cvss 7.5epss 0.01
An issue was discovered in Softing OPC UA C++ SDK before 6.10. A buffer overflow or an excess allocation happens due to unchecked array and matrix bounds in structure data types.
- risk 0.49cvss 7.5epss 0.01
A crafted HTTP packet without a content-type header can create a denial-of-service condition in Softing Secure Integration Server V1.22.
- risk 0.49cvss 7.5epss 0.01
A crafted HTTP packet with a missing HTTP URI can create a denial-of-service condition in Softing Secure Integration Server V1.22.
- risk 0.49cvss 7.5epss 0.02
A crafted HTTP packet with a -1 content-length header can create a denial-of-service condition in Softing Secure Integration Server V1.22.
- risk 0.49cvss 7.5epss 0.01
Softing OPC UA C++ Server SDK, Secure Integration Server, edgeConnector, edgeAggregator, OPC Suite, and uaGate are affected by a NULL pointer dereference vulnerability.
- risk 0.49cvss 7.5epss 0.02
A crafted HTTP packet with a large content-length header can create a denial-of-service condition in Softing Secure Integration Server V1.22.
- risk 0.49cvss 7.5epss 0.02
Softing OPC UA C++ SDK (Software Development Kit) versions from 5.59 to 5.64 exported library functions don't properly validate received extension objects, which may allow an attacker to crash the software by sending a variety of specially crafted packets to access several…
- risk 0.49cvss 7.5epss 0.01
An issue was discovered in Softing OPC UA C++ SDK before 5.70. A malformed OPC/UA message abort packet makes the client crash with a NULL pointer dereference.
- risk 0.42cvss 6.5epss 0.01
An issue was discovered in Softing OPC UA C++ SDK before 5.70. An invalid XML element in the type dictionary makes the OPC/UA client crash due to an out-of-memory condition.
- risk 0.37cvss 5.7epss 0.00
Softing Secure Integration Server V1.22 is vulnerable to authentication bypass via a machine-in-the-middle attack. The default the administration interface is accessible via plaintext HTTP protocol, facilitating the attack. The HTTP request may contain the session cookie in the…