CVE-2023-27336: Softing edgeConnector Siemens OPC UA Server Null Pointer Dereference Denial-of-Service Vulnerability

Severity: high (CVSS 7.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-05-03 · updated 2026-06-17
Weakness: CWE-476

Description

Softing edgeConnector Siemens OPC UA Server Null Pointer Dereference Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Softing edgeConnector Siemens. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of OPC client certificates. The issue results from dereferencing a NULL pointer. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-20508.

Affected products

Softing edgeAggregator: before 3.70 — fixed in 3.70
Softing edgeConnector: before 3.70 — fixed in 3.70
Softing Secure Integration Server: before 1.30 — fixed in 1.30

How to fix

Upgrade to a fixed version: Softing edgeAggregator 3.70; Softing edgeConnector 3.70; Softing Secure Integration Server 1.30. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-27336 or the next vulnerability affects your stack