Executive brief
S2OPC is an open-source implementation of the OPC UA communication protocol used in industrial automation and control systems. A security flaw in how the software verifies digital certificates allows an attacker to bypass security checks by presenting a specially crafted, untrusted certificate. This could allow unauthorized users to connect to industrial equipment, potentially leading to data theft, unauthorized commands, or service disruptions.
Technical details
A vulnerability exists in the S2OPC certificate validation process, specifically within the Trust List Check step. The root cause is an incorrect length parameter used in a memcmp() operation within both the MbedTLS and CycloneCrypto wrappers. Instead of comparing the full length of the certificate, the code only compares the number of bytes corresponding to the subject length. An attacker can exploit this by crafting a certificate with the same subject name, total length, and serial number as a trusted certificate, even if the public keys differ. This allows an untrusted certificate to be accepted as trusted, enabling unauthorized network access without authentication.
Affected products
- Systerel S2OPC 1.5.0 and later
Timeline
- 2026-06-10: advisory: NVD and GitLab advisory published