node-opcua namespace default permissions bypass lets anonymous clients write and call
An industrial device communication library lets anyone change locked values!
Summary
node-opcua does not enforce namespace-level default permissions at runtime, so an unauthenticated remote client can write variables or call methods. Versions from 2.42.0 before 2.180.0 are affected, where an operator set a restrictive default and relied on inheritance.
Affected when
- Namespace default permissions set with setDefaultRolePermissions
- Nodes without explicit per-node permissions inherit the default
What to do
Update to version 2.180.0.
Products and platforms
CVE IDs
Sources
- Write-up: github.com (opens in a new tab)
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen