Executive brief
asyncua is a Python library implementing the OPC UA (Open Platform Communications) protocol, which is widely used for secure data exchange in industrial automation and control systems. A vulnerability allows unauthorized access to the Address Space (the data exposed by an OPC UA server) without proper encryption or authentication. An attacker can read and modify sensitive industrial data or device settings by connecting to the server and bypassing required security checks.
Technical details
The vulnerability is an improper authentication issue (CWE-287) in asyncua versions prior to 0.9.96. The root cause is missing validation checks for services that require an active authenticated session. An attacker can establish a secure channel with "security none" and create a session without proper authentication, then issue Read and Write requests to access or modify nodes in the Address Space. The attack requires network access to the OPC UA server but no authentication credentials. The fix was applied in version 0.9.96 and later versions.
Affected products
- FreeOpcUa asyncua before 0.9.96
Timeline
- 2022-08-29: disclosed
- 2023-10-03: advisory
- 2023-10-03: patched: version 0.9.96 released