CVE-2021-42577

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-03-11 · updated 2026-06-17
Weakness: CWE-476

Description

An issue was discovered in Softing OPC UA C++ SDK before 5.70. A malformed OPC/UA message abort packet makes the client crash with a NULL pointer dereference.

Affected products

Softing Datafeed Opc Suite: through 5.19
Softing OPC UA C++ SDK (Software Development Kit): before 5.70.0 — fixed in 5.70.0
Softing Secure Integration Server: through 1.22

How to fix

Upgrade to a fixed version: Softing OPC UA C++ SDK (Software Development Kit) 5.70.0. Check the vendor advisory for mitigations.

References

https://industrial.softing.com/fileadmin/sof-files/pdf/ia/support/Security_Bulletin_CVE-2021-42577.pdf
https://softing.com
https://industrial.softing.com/fileadmin/sof-files/pdf/ia/support/Security_Bulletin_CVE-2021-42577.pdf
https://softing.com

Get alerted when CVE-2021-42577 or the next vulnerability affects your stack