CVE-2021-32994: Softing OPC-UA C++ SDK Improper Restriction of Operations within the Bounds of a Memory Buffer
First published: Mon Apr 04 2022(Updated: )
Softing OPC UA C++ SDK (Software Development Kit) versions from 5.59 to 5.64 exported library functions don't properly validate received extension objects, which may allow an attacker to crash the software by sending a variety of specially crafted packets to access several unexpected memory locations.
Credit: ics-cert@hq.dhs.gov
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Softing Opc Ua C\+\+ Software Development Kit | >=5.59.0<5.65.0 | |
| Softing OPC UA C++ SDK (Software Development Kit) versions from 5.59 to 5.64 |
Remedy
Softing has released version 5.65 to address this vulnerability and has notified known users of the release. As this vulnerability only affects the publisher and subscriber protocol, Softing highly recommends customers using this protocol to upgrade to the latest version or disable the functionality. Please download the latest software package from the Softing website.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this Softing OPC UA C++ SDK vulnerability?
The vulnerability ID for this Softing OPC UA C++ SDK vulnerability is CVE-2021-32994.
What is the severity of CVE-2021-32994?
The severity of CVE-2021-32994 is high with a score of 7.5.
What is the description of CVE-2021-32994?
CVE-2021-32994 is a vulnerability in Softing OPC UA C++ SDK that may allow an attacker to crash the software by sending specially crafted packets to access unexpected memory locations.
Which versions of Softing OPC UA C++ SDK are affected by CVE-2021-32994?
Softing OPC UA C++ SDK versions from 5.59 to 5.64 are affected by CVE-2021-32994.
Is there a fix available for CVE-2021-32994?
Yes, a fix is available for CVE-2021-32994. It is recommended to update to version 5.65.0 or higher of Softing OPC UA C++ SDK.
- collector/nvd-index
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/last-modified-date
- agent/author
- agent/remedy
- agent/title
- agent/description
- agent/first-publish-date
- agent/references
- agent/severity
- agent/event
- collector/ics-cert-advisory
- source/ICS
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/softwarecombine
- agent/tags
- agent/trending
- vendor/softing
- canonical/softing opc ua c\+\+ software development kit
- version/softing opc ua c\+\+ software development kit/5.59.0
- canonical/softing opc ua c++ sdk (software development kit) versions from 5.59 to 5.64