CVE-2023-26150

Katalog CVE

CVSS 7.5 · High EPSS 0,52%

Kerentanan Improper Authentication pada freeopcua opcua-asyncio. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

Versions of the package asyncua before 0.9.96 are vulnerable to Improper Authentication such that it is possible to access Address Space without encryption and authentication. **Note:** This issue is a result of missing checks for services that require an active session.

Rincian

Terbit di NVD

3 Oktober 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-287: Improper Authentication

EPSS (30 hari)

0,52% peluang dieksploitasi; lebih tinggi dari 42,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/FreeOpcUa/opcua-asyncio/commit/2be7ce80df05de8d6c6ae1ebce6fa2bb7147844a patch
• https://github.com/FreeOpcUa/opcua-asyncio/commit/b4106dfd5037423c9d1810b48a97296b59cde513 patch
• https://github.com/FreeOpcUa/opcua-asyncio/pull/1015 patch
• https://security.snyk.io/vuln/SNYK-PYTHON-ASYNCUA-5673435 exploit · patch · advisory pihak ketiga
• https://gist.github.com/artfire52/84f7279a4119d6f90381ac49d7121121 exploit · advisory pihak ketiga
• https://github.com/FreeOpcUa/opcua-asyncio/issues/1014 exploit · issue tracking · advisory pihak ketiga
• https://github.com/FreeOpcUa/opcua-asyncio/releases/tag/v0.9.96 product · release notes