CVE-2018-12086: Buffer overflow in OPC UA applications allows remote attackers to trigger a stack overflow with carefully structured requests

High severity · published Sep 14, 2018

CVE-2018-12086

Buffer overflow in OPC UA applications allows remote attackers to trigger a stack overflow with carefully structured requests

7.5

CVSS

11.8%

EPSS

On KEV

Description

Buffer overflow in OPC UA applications allows remote attackers to trigger a stack overflow with carefully structured requests.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

None

Confidentiality

None

Integrity

None

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)11.8% · higher than 96% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Debian Linux · Debian

9.0 · source: NVD

Unified Architecture .net-standard · Opcfoundation

through 1.03.352.12 · source: NVD

Unified Architecture Ansic · Opcfoundation

through 1.03.340 · source: NVD

Unified Architecture-.net-legacy · Opcfoundation

through 1.03.342 · source: NVD

Unified Architecture-java · Opcfoundation

through 1.03.343 · source: NVD

Affected product

Debian Linux

Debian

All Debian Linux CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2018-12086

CVE.org

https://www.cve.org/CVERecord?id=CVE-2018-12086

lists.opensuse.org

http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00027.html

Third Party Advisory

http://www.securityfocus.com/bid/105538

Third Party Advisory

http://www.securitytracker.com/id/1041909

Vendor Advisory

https://opcfoundation-onlineapplications.org/faq/SecurityBulletins/OPC_Foundation_Security_Bulletin_CVE-2018-12086.pdf

Third Party Advisory

https://www.debian.org/security/2018/dsa-4359