ZDI-CAN-10295: (Pwn2Own) OPC Foundation UA .NET Standard CreateSessionRequest Race Condition Denial-of-Service Vulnerability
This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of OPC Foundation UA .NET Standard. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of sessions. The issue results from the lack of proper locking when performing operations on an object. An attacker can leverage this vulnerability to create a denial-of-service condition against the application.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| OPC Foundation Unified Architecture .NET Standard |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of ZDI-CAN-10295?
ZDI-CAN-10295 is classified as a denial-of-service vulnerability that poses a significant risk to affected systems.
How do I fix ZDI-CAN-10295?
To fix ZDI-CAN-10295, update your OPC Foundation UA .NET Standard installation to the latest version provided by the vendor.
What types of systems are affected by ZDI-CAN-10295?
ZDI-CAN-10295 affects installations of OPC Foundation UA .NET Standard.
Can ZDI-CAN-10295 be exploited without authentication?
Yes, ZDI-CAN-10295 can be exploited by remote attackers without requiring authentication.
What is the impact of exploitating ZDI-CAN-10295?
Exploiting ZDI-CAN-10295 can lead to a denial-of-service condition, disrupting the availability of affected systems.
- agent/references
- agent/softwarecombine
- agent/severity
- agent/title
- agent/type
- agent/description
- agent/event
- agent/source
- agent/tags
- collector/zdi-advisory
- source/ZDI
- alias/ZDI-20-536
- alias/ZDI-CAN-10295
- alias/CVE-2020-8867
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/opc foundation
- canonical/opc foundation unified architecture .net standard