{"id":"CVE-2024-42512","published":"2025-02-10T00:00:00Z","modified":"2026-10-15T00:48:21Z","title":"Vulnerability in the OPC UA .NET Standard Stack before 1.5.374.158 allows an unauthorized attacker to bypass…","vendor":null,"product":null,"tier":"tail","description":{"text":"Vulnerability in the OPC UA .NET Standard Stack before 1.5.374.158 allows an unauthorized attacker to bypass application authentication when the deprecated Basic128Rsa15 security policy is enabled.","provenance":"source","from":"CVE.org"},"cvss":{"score":8.6,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","provenance":"source","from":"CISA ADP Vulnrichment"},"epss":{"score":0.00599,"percentile":0.48654,"provenance":"source"},"cwes":[{"id":"CWE-208","name":"Observable Timing Discrepancy"}],"references":[{"url":"https://files.opcfoundation.org/SecurityBulletins/OPC%20Foundation%20Security%20Bulletin%20CVE-2024-42512.pdf","tags":[]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-858251.html","tags":[]}],"priority":{"score":15.8,"factors":[{"name":"EPSS percentile","points":9.73},{"name":"CVSS severity","points":6.02}]},"affected":[{"ecosystem":"NuGet","package":"OPCFoundation.NetStandard.Opc.Ua.Core","vulnerableRanges":["<1.5.374.158"],"patched":["1.5.374.158"],"from":["GHSA-h958-fxgg-g7w3"],"provenance":"source"}],"euvd":{"id":"EUVD-2025-5035","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-opcfoundation-netstandard-opc-ua-core-cve-2024-33862","parents":[{"from":"CVE-2024-33862","to":"CVE-2024-42512","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["Stack/Opc.Ua.Core/Stack/Tcp/TcpTransportListener.cs"],"commits":["https://github.com/OPCFoundation/UA-.NETStandard/commit/52d4492ccc928f128e7a38857fdf58d94e1e652b","https://github.com/OPCFoundation/UA-.NETStandard/commit/3543d0292556691f681e39145e2de4526b90487d"],"basis":"rarely changed file"}]}],"packageHistory":[{"cve":"CVE-2023-31048","published":"2023-12-12","fixed":"1.4.371.86","kev":false},{"cve":"CVE-2024-33862","published":"2024-07-05","fixed":"1.5.374.54","kev":false},{"cve":"CVE-2024-45526","published":"2024-10-22","fixed":"1.5.374.118","kev":false,"link":{"from":"CVE-2024-45526","to":"CVE-2024-42512","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"NuGet:OPCFoundation.NetStandard.Opc.Ua.Core","fromFixed":"1.5.374.118","toFixed":"1.5.374.158","daysApart":111}]}},{"cve":"CVE-2024-42512","published":"2025-02-10","fixed":"1.5.374.158","kev":false}],"package":"NuGet:OPCFoundation.NetStandard.Opc.Ua.Core"}}