An issue in open62541, affecting versions 1.5.5 and earlier, allows a remote attacker to trigger a DoS condition by abusing the UA_Client_getRemoteDataTypes component. The flaw causes the target application to terminate or become unresponsive, compromising availability and potentially disrupting any services that rely on the affected OPC UA client or server.

The vulnerability impacts the open62541 OPC UA stack, specifically all releases up to and including 1.5.5. Any installation that uses the UA_Client_getRemoteDataTypes interface without a later fixed version is susceptible.

The CVSS score of 7.5 reflects a moderate to high severity, and the EPSS score of < 1% indicates a very low probability of exploitation, suggesting that publicly available exploitation data is not known. The vulnerability is not listed in the CISA KEV catalog, and based on the description, it is inferred that remote exploitation requires network connectivity to the OPC UA endpoint, making it potentially reachable in exposed environments. A remote attacker could send crafted type discovery requests to exhaust resources or crash the client, yielding a denial of service impact.