CVE-2023-27321: 
C# vulnerability analysis and mitigation

CVE-2023-27321 is a vulnerability in the OPC Foundation UA .NET Standard that was discovered in early 2023. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations without requiring authentication. The vulnerability was reported by Claroty Research - Team82 researchers (Uri Katz, Noam Moshe, Vera Mens, Sharon Brizinov) and was publicly disclosed on May 4, 2023 (ZDI Advisory).

The vulnerability exists within the handling of OPC UA ConditionRefresh requests. It is triggered when a malicious client invokes the ConditionRefresh method on the server, which asynchronously executes the call in the background by starting a new thread each time being called. The vulnerability has been assigned a CVSS v3.1 base score of 5.9 with the vector string (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) (CISA Advisory).

When exploited, the vulnerability can lead to a high load situation and memory exhaustion, potentially blocking the server. This can result in a denial-of-service condition, making the affected system unavailable for legitimate users (ZDI Advisory).

The vulnerability can be exploited remotely by sending a large number of ConditionRefresh requests to the affected server. No authentication is required to exploit this vulnerability, making it particularly concerning. The attack can be performed by using a malicious OPC UA client (ZDI Advisory).

OPC Foundation has issued an update to correct this vulnerability. Users of affected systems should update to the latest version of the software. Additionally, as a general security measure, it is recommended to protect network access to devices with appropriate mechanisms and operate the devices in a protected IT environment (ZDI Advisory).