CVE-2023-27321: opc foundation ua .net standard Uncontrolled Resource Consumption
Vulnerability summary
CVE-2023-27321 is a high (CVSS 7.5) Uncontrolled Resource Consumption vulnerability in opc foundation ua .net standard. EPSS estimates a 1.05% chance of exploitation in the next 30 days, higher than 63.6% of scored vulnerabilities.
Timeline
- 07-05-2024PublishedVulnerability first disclosed.
- 02-08-2024Last modifiedVulnerability information updated.
Description
OPC Foundation UA .NET Standard ConditionRefresh Resource Exhaustion Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of OPC Foundation UA .NET Standard. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of OPC UA ConditionRefresh requests. By sending a large number of requests, an attacker can consume all available resources on the server. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-20505.
CVSS metrics
3 scores · 3 sources · 2 versions- NVDNIST7.5HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
1.05%
Chance of exploitation in the next 30 days
Percentile
64%
Versus all other CVEs
30-day change
0.00 pp
From 1.05% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
NuGet1 product
- OPCFoundation.NetStandard.Opc.Ua.Server< 1.4.371.86
Opc foundation1 product
- ua .net standard1.4.371.60
Opcfoundation1 product
- ua-.netstandard< 1.4.371.86
3 vendors · 3 products
