CVE-2026-78049: Systerel S2OPC AddNodes Service sopc_node_mgt_helper_internal.c out-of-bounds
A vulnerability has been found in Systerel S2OPC up to 1.7.3. Impacted is the function SOPCNodeMgtHelperInternalAddVariableNodeAttributes of the file src/ClientServer/addressspace/internal/sopcnodemgthelperinternal.c of the component AddNodes Service. The manipulation of the argument UserAccessLevel leads to out-of-bounds read. It is possible to initiate the attack remotely. A high degree of complexity is needed for the attack. The exploitability is considered difficult. The exploit has been disclosed to the public and may be used. The identifier of the patch is aafbd37d381b618312ebdf5ddf57027f62c14fdd. It is suggested to install a patch to address this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Systerel S2OPC AddNodes Service (src/ClientServer/address_space/internal/sopc_node_mgt_helper_internal.c)to a version that resolves this vulnerability.Patch aafbd37d381b618312ebdf5ddf57027f62c14fdd - Compensating control
Because the issue is remotely exploitable, restrict network access to the Systerel S2OPC AddNodes Service endpoint(s) to trusted hosts/IPs (e.g., via firewall/ACL) to reduce exposure.
Event History
Frequently Asked Questions
Which deployments are affected?
Systerel S2OPC versions up to and including 1.7.3 are affected. The issue is in the AddNodes Service, specifically the handling of UserAccessLevel by SOPC_NodeMgtHelperInternal_AddVariableNodeAttributes.
Can this be exploited remotely, and does an attacker need credentials?
The attack can be initiated remotely. The supplied data indicates no privileges or user interaction are required, but exploitation requires a high degree of complexity and is considered difficult.
What is the impact of successful exploitation?
The reported flaw causes an out-of-bounds read and is rated low severity with an availability impact. No confidentiality or integrity impact is indicated in the supplied vector.
What should teams do if they are affected?
Install the available patch identified as aafbd37d381b618312ebdf5ddf57027f62c14fdd. A public exploit has been disclosed, so affected deployments should prioritize applying that patch despite the reported exploitation complexity.