CVE-2023-27334: Softing edgeConnector Siemens ConditionRefresh Resource Exhaustion Denial-of-Service Vulnerability

Severity: high (CVSS 7.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-05-03 · updated 2026-06-17
Weakness: CWE-400

Description

Softing edgeConnector Siemens ConditionRefresh Resource Exhaustion Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Softing edgeConnector Siemens. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of OPC UA ConditionRefresh requests. By sending a large number of requests, an attacker can consume all available resources on the server. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-20498.

Affected products

Softing edgeAggregator: before 3.70 — fixed in 3.70
Softing edgeConnector: before 3.70 — fixed in 3.70
Softing OPC UA C++ SDK (Software Development Kit): before 6.20.1 — fixed in 6.20.1
Softing Secure Integration Server: before 1.30 — fixed in 1.30

How to fix

Upgrade to a fixed version: Softing edgeAggregator 3.70; Softing edgeConnector 3.70; Softing OPC UA C++ SDK (Software Development Kit) 6.20.1; Softing Secure Integration Server 1.30. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-27334 or the next vulnerability affects your stack