Cybersecurity specialists reported the finding of at least four vulnerabilities affecting Honeywell OPC UA Tunneller. According to the report, successful exploitation of these flaws would allow malicious hackers to access sensitive information and run arbitrary code on the affected systems.
Below are brief descriptions of the reported vulnerabilities in addition to their respective CVE tracking keys, as well as their scores according to the Common Vulnerability Scoring System (CVSS).
CVE-2020-27297: A boundary error in the affected products allows remote threat actors to send specially crafted data to the application, triggering a heap-based buffer overflow and thus running arbitrary code on the target system.
The flaw got an 8.5/10 CVSS score and, according to the cybersecurity specialists, its successful exploitation may result in the full compromise of victims’ resources.
CVE-2020-27299: A boundary condition would allow malicious remote hackers to deploy out-of-bounds read errors and access the content of the vulnerable system’s memory.
This is a medium-severity flaw that received a 6/10 CVSS score, mentioned the cybersecurity specialists.
CVE-2020-27274: The inadequate check of the return value of malloc as well as the wrong message thread handling, allow threat actors to perform denial of service (DoS) attacks.
Experts say this is a medium-severity flaw with a 6.5/10 CVSS score.
CVE-2020-27295: The affected application does not properly control consumption of internal resources. This can be abused by a remote threat actor to trigger a resources consumption leading to a DoS condition.
The flaw received a 6.5/10 CVSS score and it is considered a medium-severity vulnerability.
According to the report, the detected flaws reside in all OPC UA Tunneller versions prior to 6.3.0.8233.
Even though the vulnerabilities can be exploited by remote non-authenticated attackers via the public Internet, the cybersecurity experts have no detected any active exploitation attempt or even the existence of a malware variant related to the attack. The four flaws have already been patched, so the developers urge system administrators to update their installations and prevent exploitation risks.
For further reports on vulnerabilities, exploits, malware variants, cybersecurity risks and information security courses fell free to visit the International Institute of Cyber Security (IICS) websites, as well as the official platforms of technology companies.
He is a well-known expert in mobile security and malware analysis. He studied Computer Science at NYU and started working as a cyber security analyst in 2003. He is actively working as an anti-malware expert. He also worked for security companies like Kaspersky Lab. His everyday job includes researching about new malware and cyber security incidents. Also he has deep level of knowledge in mobile security and mobile vulnerabilities.
