All versions of package opcua; all versions of package asyncua are vulnerable to Denial of Service (DoS) due to a missing limitation on the number of received chunks - per single session or in total for all concurrent sessions. An attacker can exploit this vulnerability by sending an unlimited number of huge chunks (e.g. 2GB each) without sending the Final closing chunk.

Threat-Mapped Scoring

Score: 1.5

Priority: P4 - Informational (Low)

• S10 – Denial of Service

EPSS

Score: 0.00086
Percentile: 0.25949

CVSS Scoring

Mapped CWE(s)

• CWE-770 : Allocation of Resources Without Limits or Throttling

All CAPEC(s)

CAPEC(s) with Mapped TTPs

Mapped ATT&CK TTPs

• T1498.001 : Direct Network Flood
  Kill Chain: impact
• T1499 : Endpoint Denial of Service
  Kill Chain: impact
• T1499.003 : Application Exhaustion Flood
  Kill Chain: impact
• T1499.002 : Service Exhaustion Flood
  Kill Chain: impact
• T1498.001 : Direct Network Flood
  Kill Chain: impact
• T1499.001 : OS Exhaustion Flood
  Kill Chain: impact
• T1499.002 : Service Exhaustion Flood
  Kill Chain: impact
• T1499.002 : Service Exhaustion Flood
  Kill Chain: impact
• T1499.002 : Service Exhaustion Flood
  Kill Chain: impact
• T1498.002 : Reflection Amplification
  Kill Chain: impact
• T1499.002 : Service Exhaustion Flood
  Kill Chain: impact
• T1498.001 : Direct Network Flood
  Kill Chain: impact

Malware

APTs Threat Group Associations

Campaigns

Affected Products

• cpe:2.3:a:asyncua_project:asyncua:*:*:*:*:*:python:*:*
• cpe:2.3:a:opcua_project:opcua:*:*:*:*:*:python:*:*

← Back to Home