{"document":{"acknowledgments":[{"organization":"CERT@VDE","summary":"coordination","urls":["https://certvde.com"]},{"organization":"OPC Foundation","summary":"reporting"},{"organization":"Unified Automation","summary":"reporting"}],"category":"csaf_security_advisory","csaf_version":"2.0","distribution":{"tlp":{"label":"WHITE","url":"https://www.first.org/tlp/"}},"lang":"en-GB","notes":[{"category":"summary","text":"By tricking clients of the mentioned products into contacting malicious OPC UA servers and thereby acting as OPC UA clients, a crash of the component can be provoked.","title":"Summary"},{"category":"description","text":"The mentioned products can be used as clients which contact an OPC UA server. If such connection is made with SecurityMode=None for the connection then the client can receive a malformed message during the conversation which provokes a null pointer dereference within the OPC UA stack of the product. The product crashes then by memory access violation. Though this is uncommon and not recommended, such connections with SecurityMode=None may even be used by OPC UA Servers, for example if they act as client to register at a Discovery Server.","title":"Impact"},{"category":"description","text":"Have your applications configured to use other than SecurityMode=None for all OPC UA connections. Avoid that these connect to an unknown OPC UA server with SecurityMode=None. In particular, avoid that your applications connect to servers which they discover via mDNS, a Local Discovery Server (LDS), an untrusted Global Discovery Server (GDS) or even trusted GDS using SecurityMode=none. Especially in the latter case an adversary might be able to apply the 'man in the middle' pattern to attack the connection and inject a bad message which triggers the vulnerability.","title":"Mitigation"},{"category":"description","text":"Please update to a recent version of the affected product.","title":"Remediation"}],"publisher":{"category":"vendor","contact_details":"product-securityincident@beckhoff.com","name":"Beckhoff Automation GmbH & Co. KG","namespace":"https://www.beckhoff.com"},"references":[{"category":"self","summary":"VDE-2022-003: BECKHOFF: Null Pointer Dereference vulnerability in products with OPC UA technology - HTML","url":"https://certvde.com/en/advisories/VDE-2022-003/"},{"category":"self","summary":"VDE-2022-003: BECKHOFF: Null Pointer Dereference vulnerability in products with OPC UA technology - CSAF","url":"https://beckhoff.csaf-tp.certvde.com/.well-known/csaf/white/2022/vde-2022-003.json"},{"category":"external","summary":"Vendor PSIRT","url":"https://www.beckhoff.com"},{"category":"external","summary":"CERT@VDE Security Advisories for Beckhoff Automation GmbH & Co. KG","url":"https://certvde.com/en/advisories/vendor/beckhoff/"}],"title":"BECKHOFF: Null Pointer Dereference vulnerability in products with OPC UA technology","tracking":{"aliases":["VDE-2022-003"],"current_release_date":"2025-06-05T13:28:13.000Z","generator":{"date":"2025-05-08T11:17:51.310Z","engine":{"name":"Secvisogram","version":"2.5.25"}},"id":"VDE-2022-003","initial_release_date":"2022-03-01T12:34:00.000Z","revision_history":[{"date":"2022-03-01T12:34:00.000Z","number":"1","summary":"Initial revision."},{"date":"2025-06-05T13:28:13.000Z","number":"2","summary":"Fix: quotation mark"}],"status":"final","version":"2"}},"product_tree":{"branches":[{"branches":[{"branches":[{"branches":[{"category":"product_version_range","name":"<3.2.0.239","product":{"name":"EK9160 (TcOpcUaServer) <3.2.0.239","product_id":"CSAFPID-51001"}}],"category":"product_name","name":"EK9160 (TcOpcUaServer)"},{"branches":[{"category":"product_version_range","name":"<3.1.0.8","product":{"name":"IPC Diagnostic UA Server on windows images (MDP UA Server) <3.1.0.8","product_id":"CSAFPID-51002"}}],"category":"product_name","name":"IPC Diagnostic UA Server on windows images (MDP UA Server)"},{"branches":[{"category":"product_version_range","name":"<1.12.754.0","product":{"name":"TF2110 (Setup) <1.12.754.0","product_id":"CSAFPID-51003"}}],"category":"product_name","name":"TF2110 (Setup)"},{"branches":[{"category":"product_version_range","name":"<2.2.9.1","product":{"name":"TF6100-OPC-UA-Client (TcOpcUaClient) <2.2.9.1","product_id":"CSAFPID-51004"}}],"category":"product_name","name":"TF6100-OPC-UA-Client (TcOpcUaClient)"},{"branches":[{"category":"product_version_range","name":"<1.5.8.454","product":{"name":"TF6100-OPC-UA-Gateway (TcOpcUaGateway) <1.5.8.454","product_id":"CSAFPID-51005"}}],"category":"product_name","name":"TF6100-OPC-UA-Gateway (TcOpcUaGateway)"},{"branches":[{"category":"product_version_range","name":"<3.2.0.240","product":{"name":"TF6100-OPC-UA-Server (TcOpcUaServer) <3.2.0.240","product_id":"CSAFPID-51006"}}],"category":"product_name","name":"TF6100-OPC-UA-Server (TcOpcUaServer)"},{"branches":[{"category":"product_version_range","name":"<2.2.9.1","product":{"name":"TS6100-0030-OPC-UA (TcOpcUaClient) <2.2.9.1","product_id":"CSAFPID-51007"}}],"category":"product_name","name":"TS6100-0030-OPC-UA (TcOpcUaClient)"},{"branches":[{"category":"product_version_range","name":"<1.5.8.454","product":{"name":"TS6100-0030-OPC-UA (TcOpcUaGateway) <1.5.8.454","product_id":"CSAFPID-51008"}}],"category":"product_name","name":"TS6100-0030-OPC-UA (TcOpcUaGateway)"},{"branches":[{"category":"product_version_range","name":"<3.2.0.240","product":{"name":"TS6100-0030-OPC-UA (TcOpcUaServer) <3.2.0.240","product_id":"CSAFPID-51009"}}],"category":"product_name","name":"TS6100-0030-OPC-UA (TcOpcUaServer)"},{"branches":[{"category":"product_version_range","name":"<2.2.9.1","product":{"name":"TS6100-OPC-UA (TcOpcUaClient) <2.2.9.1","product_id":"CSAFPID-510010"}}],"category":"product_name","name":"TS6100-OPC-UA (TcOpcUaClient)"},{"branches":[{"category":"product_version_range","name":"<1.5.8.454","product":{"name":"TS6100-OPC-UA (TcOpcUaGateway) <1.5.8.454","product_id":"CSAFPID-510011"}}],"category":"product_name","name":"TS6100-OPC-UA (TcOpcUaGateway)"},{"branches":[{"category":"product_version_range","name":"<3.2.0.240","product":{"name":"TS6100-OPC-UA (TcOpcUaServer) <3.2.0.240","product_id":"CSAFPID-510012"}}],"category":"product_name","name":"TS6100-OPC-UA (TcOpcUaServer)"}],"category":"product_family","name":"Software"}],"category":"vendor","name":"BECKHOFF"}],"product_groups":[{"group_id":"CSAFGID-0001","product_ids":["CSAFPID-51001","CSAFPID-51002","CSAFPID-51003","CSAFPID-51004","CSAFPID-51005","CSAFPID-51006","CSAFPID-51007","CSAFPID-51008","CSAFPID-51009","CSAFPID-510010","CSAFPID-510011","CSAFPID-510012"],"summary":"Affected products."}]},"vulnerabilities":[{"cve":"CVE-2021-45117","cwe":{"id":"CWE-476","name":"NULL Pointer Dereference"},"notes":[{"category":"description","text":"The OPC autogenerated ANSI C stack stubs (in the NodeSets) do not handle all error cases. This can lead to a NULL pointer dereference.","title":"Vulnerability Description"}],"product_status":{"known_affected":["CSAFPID-51001","CSAFPID-51002","CSAFPID-51003","CSAFPID-51004","CSAFPID-51005","CSAFPID-51006","CSAFPID-51007","CSAFPID-51008","CSAFPID-51009","CSAFPID-510010","CSAFPID-510011","CSAFPID-510012"]},"remediations":[{"category":"mitigation","details":"Have your applications configured to use other than SecurityMode=None for all OPC UA connections. Avoid that these connect to an unknown OPC UA server with SecurityMode=None. In particular, avoid that your applications connect to servers which they discover via mDNS, a Local Discovery Server (LDS), an untrusted Global Discovery Server (GDS) or even trusted GDS using SecurityMode=none. Especially in the latter case an adversary might be able to apply the 'man in the middle' pattern to attack the connection and inject a bad message which triggers the vulnerability.","group_ids":["CSAFGID-0001"]},{"category":"vendor_fix","details":"Please update to a recent version of the affected product.","group_ids":["CSAFGID-0001"]}],"scores":[{"cvss_v3":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","environmentalScore":6.5,"environmentalSeverity":"MEDIUM","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","temporalScore":6.5,"temporalSeverity":"MEDIUM","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"products":["CSAFPID-51001","CSAFPID-51002","CSAFPID-51003","CSAFPID-51004","CSAFPID-51005","CSAFPID-51006","CSAFPID-51007","CSAFPID-51008","CSAFPID-51009","CSAFPID-510010","CSAFPID-510011","CSAFPID-510012"]}],"title":"CVE-2021-45117"}]}