Vulnerability · Published May 3, 2024 · Assigned by zdi

CVE-2023-27336Softing edgeConnector Siemens OPC UA Server Null Pointer Dereference Denial-of-Service Vulnerability

High 7.5

In plain English

A high-severity null pointer dereference in edgeConnector Siemens from Softing. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 57% of all known vulnerabilities).

Severity (CVSS 3.0)7.5High

Exploit odds (30 days)0.8%top 42.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Softing edgeConnector Siemens OPC UA Server Null Pointer Dereference Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Softing edgeConnector Siemens. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of OPC client certificates. The issue results from dereferencing a NULL pointer. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-20508.

Affected products (as reported)

Vendor	Product	Versions
Softing	edgeConnector Siemens	3.40

Weakness: CWE-476 · Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

ZDI-23-1065 x_research-advisory