CVE-2020-8867: (Pwn2Own) OPC Foundation UA .NET Standard CreateSessionRequest Race Condition Denial-of-Service Vulnerability
First published: Wed Apr 22 2020(Updated: )
This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of OPC Foundation UA .NET Standard 1.04.358.30. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of sessions. The issue results from the lack of proper locking when performing operations on an object. An attacker can leverage this vulnerability to create a denial-of-service condition against the application. Was ZDI-CAN-10295.
Credit: zdi-disclosures@trendmicro.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Opcfoundation Unified Architecture .net-standard | <=1.04.358.30 | |
| OPC Foundation UA .NET Standard |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2020-8867?
CVE-2020-8867 is a vulnerability in OPC Foundation UA .NET Standard 1.04.358.30 that allows remote attackers to create a denial-of-service condition.
How severe is CVE-2020-8867?
CVE-2020-8867 has a severity rating of 7.5 (high).
How does CVE-2020-8867 affect OPC Foundation UA .NET Standard?
CVE-2020-8867 affects OPC Foundation UA .NET Standard 1.04.358.30 installations.
Is authentication required to exploit CVE-2020-8867?
No, authentication is not required to exploit CVE-2020-8867.
Are there any references related to CVE-2020-8867?
Yes, you can find more information about CVE-2020-8867 in the OPC Foundation Security Bulletin and the Zero Day Initiative advisory.
- collector/nvd-index
- agent/weakness
- agent/references
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/severity
- agent/author
- agent/last-modified-date
- agent/description
- agent/event
- agent/tags
- agent/first-publish-date
- collector/zdi-advisory
- source/ZDI
- alias/ZDI-20-536
- alias/ZDI-CAN-10295
- alias/CVE-2020-8867
- agent/software-canonical-lookup
- vendor/opcfoundation
- canonical/opcfoundation unified architecture .net-standard
- version/opcfoundation unified architecture .net-standard/1.04.358.30
- vendor/opc foundation
- canonical/opc foundation ua .net standard