CVE-2022-29864: 
C# vulnerability analysis and mitigation

OPC UA .NET Standard Stack 1.04.368 contains a vulnerability (CVE-2022-29864) that allows a remote attacker to cause a server to crash via a large number of messages that trigger Uncontrolled Resource Consumption. The vulnerability was discovered in 2022 and affects OPC Foundation UA .NET Standard installations (NVD, ZDI).

The vulnerability exists within the handling of message chunks. When an attacker sends a large number of requests, it can cause the number of sessions to grow without limit, leading to uncontrolled resource consumption. The vulnerability has been assigned a CVSS v3.1 Base Score of 7.5 HIGH (Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and is classified as CWE-400 (Uncontrolled Resource Consumption) (NVD, ZDI).

An attacker can leverage this vulnerability to create a denial-of-service condition on the system, causing the server to become unresponsive. The vulnerability affects the availability of the system but does not impact confidentiality or integrity (ZDI).

OPC Foundation has issued an update to correct this vulnerability. Users should upgrade to the latest version of the OPC UA .NET Standard Stack (OPC Security, ZDI).