High severity · published May 15, 2023
CVE-2023-32787
The OPC UA Legacy Java Stack before 6f176f2 enables an attacker to block OPC UA server applications via uncontrolled resource consumption so that they can no longer serve client…
7.5
CVSS
1.2%
EPSS
No
On KEV
Description
The OPC UA Legacy Java Stack before 6f176f2 enables an attacker to block OPC UA server applications via uncontrolled resource consumption so that they can no longer serve client applications.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 67% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
UH
UA Historian · Prosysopc
before 1.2.0 · source: NVD
UJ
UA Java Legacy · Opcfoundation
before 2023-04-28 · source: NVD
UM
UA Modbus Server · Prosysopc
before 1.4.20 · source: NVD
US
UA Simulation Server · Prosysopc
before 5.4.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-32787
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-32787
Patch
https://files.opcfoundation.org/SecurityBulletins/OPC%20Foundation%20Security%20Bulletin%20CVE-2023-32787.pdf
Product
https://github.com/OPCFoundation/UA-Java-Legacy
Patch
https://github.com/OPCFoundation/UA-Java-Legacy/commit/6f176f2b445a27c157f1a32f225accc9ce8873c0