CVE-2021-40873

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-11-10 · updated 2026-06-17
Weakness: CWE-415

Description

An issue was discovered in Softing Industrial Automation OPC UA C++ SDK before 5.66, and uaToolkit Embedded before 1.40. Remote attackers to cause a denial of service (DoS) by sending crafted messages to a client or server. The server process may crash unexpectedly because of a double free, and must be restarted.

Affected products

Softing Datafeed Opc Suite: before 5.18 — fixed in 5.18
Softing edgeConnector: through 2.31
Softing Industrial Automation all versions prior to the latest build of version 4.47.0 OPC: before 5.66 — fixed in 5.66
Softing Secure Integration Server: through 1.22
Softing Th Scope: from 3.5
Softing Uagates: before 1.73 — fixed in 1.73
Softing Uatoolkit Embedded: before 1.40 — fixed in 1.40

How to fix

Upgrade to a fixed version: Softing Datafeed Opc Suite 5.18; Softing Industrial Automation all versions prior to the latest build of version 4.47.0 OPC 5.66; Softing Uagates 1.73; Softing Uatoolkit Embedded 1.40. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-40873 or the next vulnerability affects your stack