CVE-2021-42577
📋 TL;DR
This vulnerability in Softing OPC UA C++ SDK allows remote attackers to crash client applications by sending a specially crafted OPC/UA abort packet, causing a NULL pointer dereference. It affects systems using Softing OPC UA C++ SDK versions before 5.70. The crash can lead to denial of service for OPC/UA communication.
💻 Affected Systems
- Softing OPC UA C++ SDK
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete denial of service for OPC/UA communication, potentially disrupting industrial control systems or SCADA operations that rely on this SDK.
Likely Case
Client application crashes, requiring manual restart and causing temporary disruption to OPC/UA data exchange.
If Mitigated
No impact if patched or if network controls prevent malicious packets from reaching vulnerable systems.
🎯 Exploit Status
Exploitation requires sending a malformed OPC/UA abort packet to a vulnerable client. No authentication needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.70 and later
Vendor Advisory: https://industrial.softing.com/fileadmin/sof-files/pdf/ia/support/Security_Bulletin_CVE-2021-42577.pdf
Restart Required: Yes
Instructions:
1. Download Softing OPC UA C++ SDK version 5.70 or later from Softing website. 2. Replace existing SDK installation with new version. 3. Recompile and redeploy any applications using the SDK. 4. Restart affected applications.
🔧 Temporary Workarounds
Network Segmentation
allRestrict network access to OPC/UA clients to trusted sources only
Firewall Rules
allImplement firewall rules to block unexpected OPC/UA traffic
🧯 If You Can't Patch
- Implement strict network segmentation to isolate OPC/UA systems
- Deploy intrusion detection systems to monitor for malformed OPC/UA packets
🔍 How to Verify
Check if Vulnerable:
Check SDK version in application build configuration or linked libraries. If using SDK version <5.70, system is vulnerable.Check Version:
Check SDK version in project configuration files or contact application vendor for version information.Verify Fix Applied:
Verify SDK version is 5.70 or later in application configuration and libraries.📡 Detection & Monitoring
Log Indicators:
- Application crash logs mentioning OPC/UA client
- Unexpected process termination of OPC/UA applications
Network Indicators:
- Malformed OPC/UA abort packets in network traffic
- Unusual OPC/UA protocol violations
SIEM Query:
Process termination events for OPC/UA client applications OR network traffic containing OPC/UA abort packets with abnormal structure