CVE-2021-27432
📋 TL;DR
This vulnerability in OPC Foundation UA .NET Standard and Legacy libraries allows attackers to trigger uncontrolled recursion leading to stack overflow. It affects industrial control systems using vulnerable OPC UA implementations, potentially causing denial of service or remote code execution.
💻 Affected Systems
- OPC Foundation UA .NET Standard
- OPC UA .NET Legacy
📦 What is this software?
Ua .net Legacy by Opcfoundation
Ua .net Standard Stack by Opcfoundation
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, process disruption in industrial environments, or persistent backdoor installation.
Likely Case
Denial of service causing OPC UA server crashes, disrupting industrial processes and communication between control systems.
If Mitigated
Limited impact with proper network segmentation and monitoring, potentially only causing service restarts.
🎯 Exploit Status
Exploitation requires sending specially crafted OPC UA messages to vulnerable endpoints.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.4.365.48 or later
Vendor Advisory: https://us-cert.cisa.gov/ics/advisories/icsa-21-133-03
Restart Required: Yes
Instructions:
1. Update OPC UA .NET Standard to version 1.4.365.48 or later. 2. Recompile and redeploy applications using the updated library. 3. Restart affected OPC UA services.
🔧 Temporary Workarounds
Network Segmentation
allIsolate OPC UA servers from untrusted networks using firewalls
Message Size Limiting
allConfigure OPC UA servers to limit maximum message size
🧯 If You Can't Patch
- Implement strict network access controls to limit OPC UA traffic to trusted sources only
- Deploy intrusion detection systems to monitor for abnormal OPC UA message patterns
🔍 How to Verify
Check if Vulnerable:
Check OPC UA library version in application dependencies or installed packagesCheck Version:
Check application configuration or package manager for OPC.UA.Core versionVerify Fix Applied:
Verify OPC UA .NET Standard version is 1.4.365.48 or higher📡 Detection & Monitoring
Log Indicators:
- OPC UA service crashes
- Stack overflow errors in application logs
- Abnormal termination of OPC UA processes
Network Indicators:
- Unusually large OPC UA messages
- Rapid sequence of OPC UA requests
- Traffic from unexpected sources to OPC UA ports (typically 4840)
SIEM Query:
source="opcua" AND (event_type="crash" OR error="stack overflow")