{
  "document": {
    "category": "opc_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "The information provided in this disclosure is provided 'as is' without warranty of any kind. OPC Foundation disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall OPC Foundation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if OPC Foundation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply"
      }
    ],
    "publisher": {
      "category": "vendor",
      "name": "OPC Foundation",
      "namespace": "https://opcfoundation.org/security/csaf"
    },
    "references": [
      {
        "category": "self",
        "summary": "Advisory Source",
        "url": "https://github.com/OPCFoundation/SecurityAdvisories/tree/latest/csaf/2026/005"
      },
      {
        "category": "external",
        "summary": "Mantis Issue",
        "url": "https://mantis.opcfoundation.org/view.php?id=9594"
      },
      {
        "category": "external",
        "summary": "A Comprehensive Formal Security Analysis of OPC UA",
        "url": "https://eprint.iacr.org/2025/148"
      }
    ],
    "title": "Security Update for the OPC UA Specification",
    "tracking": {
      "current_release_date": "2026-08-12T00:00:00Z",
      "id": "OPC-2026-08-12-005",
      "initial_release_date": "2026-08-12T00:00:00Z",
      "revision_history": [
        {
          "date": "2026-08-12T00:00:00Z",
          "number": "1.0.0",
          "summary": "Advisory created."
        }
      ],
      "status": "release",
      "version": "1.0.0"
    }
  },
  "product_tree": {
    "branches": [
      {
        "category": "product_name",
        "name": "OPC UA Specification Part 4 - Services",
        "product": {
          "name": "OPC UA Specification Part 4 - Services <1.03",
          "product_id": "CSAFPID-04",
          "product_identification_helper": {
            "skus": [
              "OPC 10000-4"
            ]
          }
        }
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "Vincent Diemunsch"
          ],
          "organization": "ANSSI & Inria, France"
        },
        {
          "names": [
            "Lucca Hirschi"
          ],
          "organization": "Inria, France"
        },
        {
          "names": [
            "Steve Kremer"
          ],
          "organization": "Inria, France",
          "summary": "For discovering the issue using the ProVerif protocol analyzer, see eprint https://eprint.iacr.org/2025/148."
        }
      ],
      "cwe": {
        "id": "CWE-347",
        "name": "Improper Verification of Cryptographic Signature"
      },
      "discovery_date": "2024-08-10T00:00:00Z",
      "ids": [
        {
          "system_name": "GCVE",
          "text": "GCVE-105-2026-005"
        }
      ],
      "involvements": [
        {
          "date": "2026-03-01T00:00:00Z",
          "party": "vendor",
          "status": "completed"
        }
      ],
      "references": [
        {
          "summary": "CWE-347: Improper Verification of Cryptographic Signature",
          "url": "https://cwe.mitre.org/data/definitions/347.html"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "OPC UA Part 4 - Services 1.03 and later require that the signature calculation be done only with the leaf certificate if the clientCertificate contains a chain. A server that meets this requirement cannot be used to sign attacker supplied data.",
          "product_ids": [
            "CSAFPID-04"
          ],
          "url": "https://reference.opcfoundation.org/Core/Part4/v105/docs/5.7.2.2"
        },
        {
          "category": "vendor_fix",
          "details": "OPC UA Part 4 - Services 1.05.07 §5.7.2.2: The clientCertificate shall be validated according to the rules in §6.1.3 even if the server chooses to allow connections from untrusted clients. This makes the rejection of malformed input explicit.",
          "product_ids": [
            "CSAFPID-04"
          ],
          "url": "https://reference.opcfoundation.org/Core/Part4/v105/docs/5.7.2.2"
        },
        {
          "category": "mitigation",
          "details": "Servers that implement version 1.02 or earlier should be contained. Do not include the certificate of such a server in the trust lists of other applications, so a signature obtained from it cannot be used against them. Disable the deprecated SecurityPolicies that use RSA PKCS#1 v1.5 and SHA-1, which are themselves vulnerable to oracle attacks, and restrict network access to legacy servers.",
          "product_ids": [
            "CSAFPID-04"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-04"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "An attacker could use a legacy server as a signature oracle to obtain a signature on data of its choosing and use it to impersonate that server to other applications that trust it."
        },
        {
          "category": "target_set",
          "details": "The attacker must be able to call CreateSession on a server that implements version 1.02 or earlier of the specification and that does not restrict the signature calculation to the leaf certificate. Other applications must trust the certificate of that server."
        }
      ],
      "title": "Servers implementing version 1.02 or earlier may be used as a signature oracle because the signature calculation is not restricted to the leaf certificate passed to CreateSession."
    }
  ]
}