Miggo Logo
Miggo Vulnerability Database
→
CVE-2022-29866

CVE-2022-29866: Uncontrolled Resource Consumption in OPCFoundation.NetStandard.Opc.Ua.Core

N/A

CVSS Score

Basic Information

CVE ID
CVE-2022-29866
GHSA ID
GHSA-6fp8-cxc9-4fr9
EPSS Score
0.73168%
CWE
CWE-400
Published
6/17/2022
Updated
1/30/2023
KEV Status
No
Technology
TechnologyC#

Technical Details

CVSS Vector
-
Package NameEcosystemVulnerable VersionsFirst Patched Version
OPCFoundation.NetStandard.Opc.Ua.Corenuget<= 1.4.368.531.4.368.58

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability manifests as a stack overflow during HTTPS message processing. Stack overflows in .NET typically occur from unbounded recursion. The advisory specifically implicates Variant handling (common in OPC UA encoding) as a recursion vector. The patched version likely added depth counters to these decoding methods. The ServerBase.SessionChannel.ProcessRequest is the entry point for HTTPS requests and would propagate malicious payloads to the vulnerable decoder.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

* vuln*r**ility w*s *is*ov*r** in t** OP* U* .N*T St*n**r* St**k t**t *llows * m*li*ious *li*nt to tri***r * st**k ov*r*low *x**ption in * s*rv*r t**t *xpos*s *n *TTPS *n*point.

Reasoning

T** vuln*r**ility m*ni**sts *s * st**k ov*r*low *urin* *TTPS m*ss*** pro**ssin*. St**k ov*r*lows in .N*T typi**lly o**ur *rom un*oun*** r**ursion. T** **visory sp**i*i**lly impli**t*s V*ri*nt **n*lin* (*ommon in OP* U* *n*o*in*) *s * r**ursion v**tor