CVE-2022-44725

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-11-17 · updated 2026-06-17
Weakness: CWE-732

Description

OPC Foundation Local Discovery Server (LDS) through 1.04.403.478 uses a hard-coded file path to a configuration file. This allows a normal user to create a malicious file that is loaded by LDS (running as a high-privilege user).

Affected products

Opcfoundation Local Discovery Server: before 1.04.405.479 — fixed in 1.04.405.479

How to fix

Upgrade to a fixed version: Opcfoundation Local Discovery Server 1.04.405.479. Check the vendor advisory for mitigations.

References

https://files.opcfoundation.org/SecurityBulletins/OPC%20Foundation%20Security%20Bulletin%20CVE-2022-44725.pdf
https://opcfoundation.org/developer-tools/samples-and-tools-unified-architecture/local-discovery-server-lds/
https://files.opcfoundation.org/SecurityBulletins/OPC%20Foundation%20Security%20Bulletin%20CVE-2022-44725.pdf
https://opcfoundation.org/developer-tools/samples-and-tools-unified-architecture/local-discovery-server-lds/

Get alerted when CVE-2022-44725 or the next vulnerability affects your stack