CVE-2023-26150

CVSS 6.5 MEDIUMEPSS 0.5%CWE-287

Vexday Risk Score

13Bajo

Decisión SSVC (CISA)

Track

Sin señal de explotación → monitorear

CVSS 6.5EPSS 0.5%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

03 oct 2023Publicada en NVD

Recomendación: Monitorear — sin señal de explotación por ahora.

Versions of the package asyncua before 0.9.96 are vulnerable to Improper Authentication such that it is possible to access Address Space without encryption and authentication. **Note:** This issue is a result of missing checks for services that require an active session.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:P

Productos afectados

n/a · asyncua

Referencias

https://gist.github.com/artfire52/84f7279a4119d6f90381ac49d7121121 https://github.com/FreeOpcUa/opcua-asyncio/commit/2be7ce80df05de8d6c6ae1ebce6fa2bb7147844a https://github.com/FreeOpcUa/opcua-asyncio/commit/b4106dfd5037423c9d1810b48a97296b59cde513 https://github.com/FreeOpcUa/opcua-asyncio/issues/1014 https://github.com/FreeOpcUa/opcua-asyncio/pull/1015 https://github.com/FreeOpcUa/opcua-asyncio/releases/tag/v0.9.96 https://security.snyk.io/vuln/SNYK-PYTHON-ASYNCUA-5673435