CVE-2022-37012

Deeper analysis

This vulnerability affects Unified Automation OPC UA C++ Demo Server version 1.7.6-537 and resides in the OpcUa_SecureListener_ProcessSessionCallRequest method. A remote attacker can submit a specially crafted OPC UA message that causes the server to mishandle a reference count, triggering a denial-of-service condition. The issue carries a CVSS 3.1 score of 7.5 and maps to CWE-911; no authentication or user interaction is required.

An unauthenticated attacker with network access to an affected installation can repeatedly send the malicious message to crash or hang the server, disrupting any OPC UA clients that depend on it. Because the flaw is triggered at the protocol-message level, exploitation requires only the ability to reach the server’s listening port.

Vendor documentation for the 1.7.7 release and the corresponding Zero Day Initiative advisory ZDI-22-1030 indicate that the reference-count handling error has been corrected in that update. Administrators are advised to upgrade from 1.7.6-537 to 1.7.7 or later to eliminate the flaw.

The associated EPSS score has remained flat at 0.0691 since disclosure, indicating no significant increase in observed exploitation interest.