CVE-2017-11672

Severity: high (CVSS 7.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-06-13 · updated 2026-06-17
Weakness: CWE-428

Description

The OPC Foundation Local Discovery Server (LDS) before 1.03.367 is installed as a Windows Service without adding double quotes around the opcualds.exe executable path, which might allow local users to gain privileges.

Affected products

Opcfoundation Local Discovery Server: before 1.03.367 — fixed in 1.03.367

How to fix

Upgrade to a fixed version: Opcfoundation Local Discovery Server 1.03.367. Check the vendor advisory for mitigations.

References

https://opcfoundation-onlineapplications.org/faq/SecurityBulletins/OPC_Foundation_Security_Bulletin_CVE-2017-11672.pdf
https://opcfoundation-onlineapplications.org/faq/SecurityBulletins/OPC_Foundation_Security_Bulletin_CVE-2017-11672.pdf

Get alerted when CVE-2017-11672 or the next vulnerability affects your stack