Description

A vulnerability has been found in Systerel S2OPC up to 1.7.3. Impacted is the function SOPC_NodeMgtHelperInternal_AddVariableNodeAttributes of the file src/ClientServer/address_space/internal/sopc_node_mgt_helper_internal.c of the component AddNodes Service. The manipulation of the argument UserAccessLevel leads to out-of-bounds read. It is possible to initiate the attack remotely. A high degree of complexity is needed for the attack. The exploitability is considered difficult. The exploit has been disclosed to the public and may be used. The identifier of the patch is aafbd37d381b618312ebdf5ddf57027f62c14fdd. It is suggested to install a patch to address this issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.7",
  "pubDate": "2026-08-22T23:16:22.723Z",
  "pubdate": "2026-08-22T23:16:22.723Z",
  "executiveSummary": "An out-of-bounds read vulnerability has been identified in Systerel S2OPC up to version 1.7.3, specifically within the AddNodes Service component. The flaw resides in the function SOPC_NodeMgtHelperInternal_AddVariableNodeAttributes located in the file src/ClientServer/address_space/internal/sopc_node_mgt_helper_internal.c.\nThe vulnerability is triggered via the manipulation of the UserAccessLevel argument during node management operations. Successful exploitation of this vulnerability can result in an out-of-bounds read condition, potentially exposing sensitive memory contents or leading to service instability.\nThe attack can be initiated remotely over the network, lowering the barrier for remote adversaries. However, the attack requires a high degree of complexity, and the overall exploitability is considered difficult. Public disclosure of an exploit increases the urgency for remediation.\nOrganizations utilizing affected versions of Systerel S2OPC must apply the provided software patch to secure the address space management logic and prevent unauthorized memory disclosures.",
  "technicalDetails": "The vulnerability is rooted in insufficient input validation and bounds checking of the UserAccessLevel argument processed by the SOPC_NodeMgtHelperInternal_AddVariableNodeAttributes function within the src/ClientServer/address_space/internal/sopc_node_mgt_helper_internal.c file.\nDuring the processing of the AddNodes Service requests, specifically when handling variable node attributes, the internal helper function processes the UserAccessLevel parameter supplied by the client. Due to inadequate validation of this argument against expected boundaries or lookup tables, an attacker can supply a specially crafted value.\nThis manipulated value causes the internal logic to read memory addresses outside the intended allocation bounds of the underlying data structure or array, resulting in an out-of-bounds read.\nThe attack flow proceeds as follows: 1) The remote attacker establishes a connection to the vulnerable OPC UA server endpoint exposed by Systerel S2OPC. 2) The attacker crafts and transmits a malicious AddNodes Service request containing a manipulated UserAccessLevel argument. 3) The server parses the request and executes the vulnerable SOPC_NodeMgtHelperInternal_AddVariableNodeAttributes function. 4) The function utilizes the malicious argument to perform memory operations, reading past the boundaries of the intended buffer or address space structure. 5) Depending on the implementation and context, the out-of-bounds read data may be processed internally or potentially reflected back, leading to information disclosure or triggering an application crash via a segmentation fault.\nThe vulnerable component is the AddNodes Service handling routines within S2OPC versions up to 1.7.3. The attack vector is remote, requiring network access to the OPC UA service. Although authentication requirements depend on the specific server configuration, the attack complexity is evaluated as high and exploitability is difficult due to the precise crafting required for the manipulated argument to yield a predictable or exploitable state."
}