Executive brief
Systerel S2OPC is an open-source implementation of the OPC UA protocol, commonly used in industrial control systems and IIoT applications for secure device communication. A vulnerability in the AddNodes Service allows an attacker to trigger an out-of-bounds memory read by manipulating node attributes during node creation, potentially leading to information disclosure or service disruption with network access from a remote location.
Technical details
The vulnerability is an out-of-bounds read in the function SOPC_NodeMgtHelperInternal_AddVariableNodeAttributes within src/ClientServer/address_space/internal/sopc_node_mgt_helper_internal.c. It is triggered by improper handling of the UserAccessLevel argument when processing NodeAttributes during AddNodes Service operations. The attack is remotely exploitable but requires a high degree of complexity to execute. The patch (commit aafbd37d) fixes the issue by implementing proper shallow copies of VariableAttributes, ObjectAttributes, and MethodAttributes structures to ensure bounds-safe attribute handling. The vulnerability allows remote attackers to read memory contents beyond intended boundaries.
Affected products
- Systerel S2OPC up to 1.7.3
Timeline
- 2026-08-22: disclosed: Vulnerability disclosed publicly
- 2026-07-08: patched: Patch commit aafbd37d381b618312ebdf5ddf57027f62c14fdd published