Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2019-19135

In OPC Foundation OPC UA .NET Standard codebase 1.4.357.28, servers do not create sufficiently random numbers in OPCFoundation.NetStandard.Opc.Ua before 1.4.359.31, which allows man in the middle attackers to reuse encrypted user credentials sent over the network.

Published

2020-03-16T16:15:11.937

Last Modified

2024-11-21T04:34:14.993

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 7.4 (HIGH)

CVSSv2 Vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

  • Access Vector: NETWORK
  • Access Complexity: MEDIUM
  • Authentication: NONE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: PARTIAL
  • Availability Impact: NONE
Exploitability Score

8.6

Impact Score

4.9

Weaknesses
  • Type: Primary
    CWE-330
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application opcfoundation netstandard.opc.ua < 1.4.359.31 Yes
Application opcfoundation ua-.netstandard 1.4.357.28 Yes
References