CVE-2023-27334
📋 TL;DR
This vulnerability allows remote attackers to cause a denial-of-service condition in Softing edgeConnector Siemens by sending excessive OPC UA ConditionRefresh requests, which exhausts server resources. It affects installations of Softing edgeConnector Siemens without requiring authentication.
💻 Affected Systems
- Softing edgeConnector Siemens
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system unavailability due to resource exhaustion, disrupting industrial operations and potentially causing safety or production issues.
Likely Case
Service degradation or temporary unavailability of the OPC UA server functionality, impacting data collection and control systems.
If Mitigated
Minimal impact with proper network segmentation and rate limiting in place.
🎯 Exploit Status
Simple resource exhaustion attack requiring only network access to the OPC UA port.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check vendor advisory for specific patched version
Vendor Advisory: https://industrial.softing.com/fileadmin/psirt/downloads/syt-2023-1.html
Restart Required: Yes
Instructions:
1. Download the latest version from Softing's website
2. Follow vendor's upgrade instructions
3. Restart the edgeConnector service
🔧 Temporary Workarounds
Network Segmentation
allRestrict access to the OPC UA port (typically 4840/tcp) to trusted networks only.
Rate Limiting
allImplement network-level rate limiting for OPC UA traffic to prevent request flooding.
🧯 If You Can't Patch
- Implement strict network access controls to limit who can reach the OPC UA interface
- Deploy intrusion prevention systems with DoS protection rules
🔍 How to Verify
Check if Vulnerable:
Check edgeConnector Siemens version against vendor advisory. If running unpatched version and OPC UA interface is exposed, assume vulnerable.Check Version:
Check version through edgeConnector management interface or installation directoryVerify Fix Applied:
Verify installation of patched version from vendor advisory and confirm OPC UA service is running normally under load testing.📡 Detection & Monitoring
Log Indicators:
- High frequency of OPC UA ConditionRefresh requests
- Resource exhaustion warnings in system logs
- Service restart events
Network Indicators:
- Unusually high volume of traffic to OPC UA port (4840/tcp)
- Multiple ConditionRefresh requests from single source
SIEM Query:
source_port=4840 AND (event_type="ConditionRefresh" OR protocol="OPC-UA") | stats count by src_ip | where count > threshold