Description
Buffer Overflow vulnerability in Systerel S2OPC 1.7.3 allows a remote attacker to cause a denial of service via the LockedStaMac_ProcessMsg_DeleteMonitoredItemsResponse and SOPC_StaMac_NewDeleteMonitoredItems in the client wrapper DeleteMonitoredItems path
Published: 2026-08-05
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A buffer overflow exists in the Systerel S2OPC client wrapper implementation of DeleteMonitoredItems, specifically in the functions LockedStaMac_ProcessMsg_DeleteMonitoredItemsResponse and SOPC_StaMac_NewDeleteMonitoredItems. When a crafted DeleteMonitoredItems response is received, the overflow corrupts memory and allows a remote attacker to crash the process, resulting in a denial of service. This vulnerability is a classic buffer overflow issue where input validation is insufficient, matching the CWE‑121 vulnerability class.

Affected Systems

Systerel S2OPC version 1.7.3 is affected. No other product or version information is provided.

Risk and Exploitability

Based on the description, it is inferred that the vulnerability permits remote exploitation without authentication. The CVSS score is 7.5, the EPSS score is < 1%, and it is not listed in the KEV catalog. Attackers can easily trigger the crash by sending a malicious DeleteMonitoredItems response. Any system running the vulnerable version could be taken offline, disrupting availability of OPC UA services.

Generated by OpenCVE AI on August 6, 2026 at 18:06 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the vendor supply of a patch that eliminates the buffer overflow in the DeleteMonitoredItems path, or upgrade to any Systerel S2OPC release newer than 1.7.3 which contains the fix.
  • If no patch is available, isolate the vulnerable endpoint by network segmentation or firewall rules so that only trusted internal traffic can reach the client wrapper during DeleteMonitoredItems operations.
  • As a temporary mitigation, modify the client wrapper to enforce strict input size limits on DeleteMonitoredItems messages, preventing the buffer overflow from occurring.
  • Monitor the application logs for segmentation fault events or abnormal termination patterns indicative of an exploitation attempt.

Generated by OpenCVE AI on August 6, 2026 at 18:06 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 06 Aug 2026 18:30:00 +0000

Type Values Removed Values Added
Title Remote Denial of Service via Buffer Overflow in Systerel S2OPC

Thu, 06 Aug 2026 15:30:00 +0000

Type Values Removed Values Added
Title Buffer Overflow in Systerel S2OPC 1.7.3 Allows Remote Denial of Service
Weaknesses CWE-120
CWE-122

Thu, 06 Aug 2026 13:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-121
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 05 Aug 2026 23:45:00 +0000

Type Values Removed Values Added
Title Buffer Overflow in Systerel S2OPC 1.7.3 Allows Remote Denial of Service
First Time appeared Systerel
Systerel s2opc
Weaknesses CWE-120
CWE-122
Vendors & Products Systerel
Systerel s2opc

Wed, 05 Aug 2026 22:45:00 +0000

Type Values Removed Values Added
Description Buffer Overflow vulnerability in Systerel S2OPC 1.7.3 allows a remote attacker to cause a denial of service via the LockedStaMac_ProcessMsg_DeleteMonitoredItemsResponse and SOPC_StaMac_NewDeleteMonitoredItems in the client wrapper DeleteMonitoredItems path
References

Subscriptions

Systerel S2opc
cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2026-08-06T12:44:59.332Z

Reserved: 2026-07-30T00:00:00.000Z

Link: CVE-2026-67866

cve-icon Vulnrichment

Updated: 2026-08-06T12:44:10.922Z

cve-icon NVD

Status : Received

Published: 2026-08-05T23:16:53.887

Modified: 2026-08-06T13:18:22.723

Link: CVE-2026-67866

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-06T18:15:02Z

Weaknesses
  • CWE-121

    Stack-based Buffer Overflow