CVE-2019-19135
📋 TL;DR
This vulnerability in OPC UA .NET Standard servers allows man-in-the-middle attackers to reuse encrypted user credentials due to insufficient randomness in number generation. It affects OPC UA servers using vulnerable versions of the OPCFoundation.NetStandard.Opc.Ua library. Attackers can potentially intercept and replay authentication data to gain unauthorized access.
💻 Affected Systems
- OPC Foundation OPC UA .NET Standard
📦 What is this software?
Netstandard.opc.ua by Opcfoundation
Ua .netstandard by Opcfoundation
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain unauthorized access to OPC UA servers, potentially compromising industrial control systems, manipulating process data, or disrupting operations.
Likely Case
Credential theft leading to unauthorized access to OPC UA server endpoints and data exfiltration.
If Mitigated
Limited impact due to network segmentation, proper patching, and credential rotation.
🎯 Exploit Status
Requires man-in-the-middle position to intercept network traffic. Exploitation depends on network access and ability to capture credentials.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.4.359.31 and later
Vendor Advisory: https://opcfoundation.org/SecurityBulletins/OPC%20Foundation%20Security%20Bulletin%20CVE-2019-19135.pdf
Restart Required: Yes
Instructions:
1. Update OPCFoundation.NetStandard.Opc.Ua package to version 1.4.359.31 or later. 2. Rebuild and redeploy affected OPC UA server applications. 3. Restart OPC UA server services.
🔧 Temporary Workarounds
Network Segmentation
allIsolate OPC UA servers from untrusted networks to prevent man-in-the-middle attacks.
Credential Rotation
allRegularly rotate OPC UA user credentials to limit exposure window.
🧯 If You Can't Patch
- Implement strict network segmentation and firewall rules to limit OPC UA traffic to trusted sources only.
- Use certificate-based authentication instead of username/password credentials where possible.
🔍 How to Verify
Check if Vulnerable:
Check the version of OPCFoundation.NetStandard.Opc.Ua.dll in your OPC UA server application. Versions below 1.4.359.31 are vulnerable.Check Version:
On Windows: (Get-Item "path\to\OPCFoundation.NetStandard.Opc.Ua.dll").VersionInfo.FileVersionVerify Fix Applied:
Verify the OPCFoundation.NetStandard.Opc.Ua.dll file version is 1.4.359.31 or higher after update.📡 Detection & Monitoring
Log Indicators:
- Multiple failed authentication attempts from same source
- Unusual authentication patterns
- OPC UA security audit log anomalies
Network Indicators:
- Unencrypted OPC UA traffic (if not using encryption)
- Suspicious man-in-the-middle activity on OPC UA ports (typically 4840, 4841)
SIEM Query:
source="opc-ua-server" AND (event_type="authentication_failure" OR event_type="security_violation")