CVE-2022-37013
📋 TL;DR
CVE-2022-37013 is a denial-of-service vulnerability in Unified Automation OPC UA C++ Demo Server where remote attackers can send a specially crafted certificate to trigger an infinite loop, crashing the server. Authentication is not required for exploitation. Organizations using affected versions of this OPC UA server software are vulnerable.
💻 Affected Systems
- Unified Automation OPC UA C++ Demo Server
📦 What is this software?
Opc Ua C\+\+ Demo Server by Unified Automation
⚠️ Risk & Real-World Impact
Worst Case
Complete denial of service for OPC UA server operations, disrupting industrial control system communications and potentially affecting physical processes.
Likely Case
Server crashes requiring manual restart, causing temporary disruption to OPC UA communications and monitoring capabilities.
If Mitigated
No impact if server is patched or properly isolated from untrusted networks.
🎯 Exploit Status
ZDI-CAN-17203 was assigned, suggesting active research. The vulnerability requires crafting a malicious certificate but doesn't require authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.7.7 and later
Vendor Advisory: https://documentation.unified-automation.com/uasdkcpp/1.7.7/CHANGELOG.txt
Restart Required: Yes
Instructions:
1. Download Unified Automation OPC UA C++ SDK version 1.7.7 or later. 2. Replace the affected demo server with the updated version. 3. Restart the OPC UA server service.
🔧 Temporary Workarounds
Network Segmentation
allRestrict network access to OPC UA servers to only trusted clients and networks.
Firewall Rules
allImplement firewall rules to block untrusted sources from accessing OPC UA ports (typically 4840/tcp).
🧯 If You Can't Patch
- Implement strict network segmentation to isolate OPC UA servers from untrusted networks
- Deploy intrusion detection systems to monitor for certificate-based attacks on OPC UA ports
🔍 How to Verify
Check if Vulnerable:
Check if running Unified Automation OPC UA C++ Demo Server version 1.7.6-537 or earlier. Review server logs for certificate parsing errors or crashes.Check Version:
Check server configuration files or application properties for version information specific to your deployment.Verify Fix Applied:
Verify server version is 1.7.7 or later. Test certificate handling functionality remains operational.📡 Detection & Monitoring
Log Indicators:
- Server process crashes
- High CPU usage from infinite loops
- Certificate parsing errors
- Connection resets after certificate exchange
Network Indicators:
- Unusual certificate sizes or structures sent to OPC UA port 4840
- Multiple connection attempts with malformed certificates
SIEM Query:
source="opcua_server" AND (event="crash" OR event="certificate_error" OR cpu_usage>90)