Miggo Logo
Miggo Vulnerability Database
→
CVE-2022-29862

CVE-2022-29862:
Security Update for the OPC UA .NET Standard Stack

7.5

CVSS Score
3.1

Basic Information

CVE ID
CVE-2022-29862
GHSA ID
GHSA-5q2v-6j86-5h9v
EPSS Score
0.82043%
CWE
CWE-835
Published
6/17/2022
Updated
1/30/2023
KEV Status
No
Technology
TechnologyC#

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
OPCFoundation.NetStandard.Opc.Ua.Corenuget<= 1.4.368.531.4.368.58

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability (CWE-835) involves an infinite loop during secure channel message processing. The BinaryDecoder.ReadMessage method is a core message parsing component in OPC UA .NET Standard Stack, responsible for decoding incoming messages. A crafted message could exploit improper loop termination checks in this method, causing indefinite processing. The patched version (1.4.368.58) likely added validation to break the loop. While exact code isn't available, the function's role in message decoding aligns with the described attack vector.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

* vuln*r**ility w*s *is*ov*r** in OP* U* .N*T St*n**r* St**k t**t *llows * m*li*ious *li*nt or s*rv*r to **us* * p**r to **n* wit* * **r**ully *r**t** m*ss*** s*nt *urin* s**ur* ***nn*l *r**tion.

Reasoning

T** vuln*r**ility (*W*-***) involv*s *n in*init* loop *urin* s**ur* ***nn*l m*ss*** pro**ssin*. T** `*in*ry***o**r.R***M*ss***` m*t*o* is * *or* m*ss*** p*rsin* *ompon*nt in OP* U* .N*T St*n**r* St**k, r*sponsi*l* *or ***o*in* in*omin* m*ss***s. * *r