High severity · published Jan 26, 2021
CVE-2020-27295
The affected product has uncontrolled resource consumption issues, which may allow an attacker to cause a denial-of-service condition on the OPC UA Tunneller (versions prior to…
7.5
CVSS
1.5%
EPSS
No
On KEV
Description
The affected product has uncontrolled resource consumption issues, which may allow an attacker to cause a denial-of-service condition on the OPC UA Tunneller (versions prior to 6.3.0.8233).
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.5% · higher than 74% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OU
Opc UA Tunneller · Honeywell
before 6.3.0.8233 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-27295
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-27295
Third Party Advisory
https://us-cert.cisa.gov/ics/advisories/icsa-21-021-03
More from Opc UA Tunneller
9.8
CVE-2020-27297
The affected product is vulnerable to a heap-based buffer overflow, which may allow an attacker to manipulate memory with controlled values and remotely execute code on the OPC UA…
9.1
CVE-2020-27299
The affected product is vulnerable to an out-of-bounds read, which may allow an attacker to obtain and disclose sensitive data information or cause the device to crash on the OPC…
7.5
CVE-2020-27274
Some parsing functions in the affected product do not check the return value of malloc and the thread handling the message is forced to close, which may lead to a…