CVSS 3.1
7.5 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NCVE-2023-26150
High (7.5) in freeopcua opcua-asyncio. EPSS 0.5% chance of exploitation in the next 30 days. Fixed in asyncua 0.9.96.
Versions of the package asyncua before 0.9.96 are vulnerable to Improper Authentication such that it is possible to access Address Space without encryption and authentication.
**Note:**
This issue is a result of missing checks for services that require an active session.
Severity
- EPSS
- 0.5% chance of exploitation in the next 30 days; higher than 44% of CVEs (scores of 2026-10-31)
- CWE
- CWE-287
- Published
- Modified
- Record from
- the NVD, synced
Affected
- freeopcua:opcua-asyncio
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-2894-qcqf-g23g | PyPI | asyncua | <0.9.96 | 0.9.96 |
| PYSEC-2023-189 | PyPI | asyncua | <0.9.96 | 0.9.96 |
References
- https://gist.github.com/artfire52/84f7279a4119d6f90381ac49d7121121
- https://github.com/FreeOpcUa/opcua-asyncio/commit/2be7ce80df05de8d6c6ae1ebce6fa2bb7147844a
- https://github.com/FreeOpcUa/opcua-asyncio/commit/b4106dfd5037423c9d1810b48a97296b59cde513
- https://github.com/FreeOpcUa/opcua-asyncio/issues/1014
- https://github.com/FreeOpcUa/opcua-asyncio/pull/1015