OPC Foundation UA .NET Standard ConditionRefresh Resource Exhaustion Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of OPC Foundation UA .NET Standard. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the handling of OPC UA ConditionRefresh requests. By sending a large number of requests, an attacker can consume all available resources on the server. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-20505.
CVSS
No CVSS.
References
| Link | Resource |
|---|---|
| https://files.opcfoundation.org/SecurityBulletins/OPC%20Foundation%20Security%20Bulletin%20CVE-2023-27321.pdf | Vendor Advisory |
| https://files.opcfoundation.org/SecurityBulletins/OPC%20Foundation%20Security%20Bulletin%20CVE-2023-27321.pdf | Vendor Advisory |
| https://www.zerodayinitiative.com/advisories/ZDI-23-548/ | Third Party Advisory |
| https://www.zerodayinitiative.com/advisories/ZDI-23-548/ | Third Party Advisory |
Configurations
History
14 Aug 2025, 01:37
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Opcfoundation ua-.netstandard
Opcfoundation |
|
| CWE | NVD-CWE-noinfo | |
| References | () https://files.opcfoundation.org/SecurityBulletins/OPC%20Foundation%20Security%20Bulletin%20CVE-2023-27321.pdf - Vendor Advisory | |
| References | () https://www.zerodayinitiative.com/advisories/ZDI-23-548/ - Third Party Advisory | |
| CPE | cpe:2.3:a:opcfoundation:ua-.netstandard:*:*:*:*:*:*:*:* |
07 May 2024, 23:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-05-07 23:15
Updated : 2025-08-14 01:37
NVD link : CVE-2023-27321
Mitre link : CVE-2023-27321
JSON object : View
Products Affected
opcfoundation
- ua-.netstandard
CWE