CVE-2022-37012: (Pwn2Own) Unified Automation OPC UA C++ Improper Update of Reference Count Denial-of-Service Vulnerability
This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Unified Automation OPC UA C++ Demo Server 1.7.6-537. Authentication is not required to exploit this vulnerability. The specific flaw exists within the OpcUaSecureListenerProcessSessionCallRequest method. A crafted OPC UA message can force the server to incorrectly update a reference count. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-16927.
Other sources
This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Unified Automation OPC UA C++ Demo Server. Authentication is not required to exploit this vulnerability. The specific flaw exists within the OpcUaSecureListenerProcessSessionCallRequest method. A crafted OPC UA message can force the server to incorrectly update a reference count. An attacker can leverage this vulnerability to create a denial-of-service condition on the system.
— ZDI
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2022-37012.
What is the severity level of CVE-2022-37012?
The severity level of CVE-2022-37012 is high with a CVSS score of 7.5.
What is the affected software for CVE-2022-37012?
The affected software is the Unified Automation OPC UA C++ Demo Server version 1.7.6-537.
Is authentication required to exploit CVE-2022-37012?
No, authentication is not required to exploit CVE-2022-37012.
How can I fix the vulnerability CVE-2022-37012?
To fix the vulnerability CVE-2022-37012, it is recommended to update to a patched version of the Unified Automation OPC UA C++ Demo Server.