The S2OPC library performs a certificate revocation check but only evaluates the first matching Certificate Revocation List (CRL) it encounters. If multiple CRLs exist for the same Certificate Authority (CA), the remainder are disregarded, allowing a connection to be established with a certificate that has been revoked. This flaw enables an attacker to bypass authentication by presenting a revoked certificate, potentially gaining unauthorized access to OPC UA servers and compromising confidentiality and integrity of the communication.

Systerel S2OPC library for all versions before commit 3ff81301d95a77260e9deb791585a620c5623028 and before release 1.7.2

The moderate CVSS rating indicates that, while the flaw does not provide immediate remote code execution, it enables attackers to connect using revoked certificates, which can be leveraged to impersonate legitimate clients or tamper with OPC UA communication. The absence of an EPSS score limits precise assessment, but the flaw is not publicly reported as a known exploit and is not in the KEV catalog, and an attacker would need to control a revoked certificate or manipulate CRL distribution to succeed. Because the vulnerability is purely a validation bypass, it is more likely to be used by insiders or network attackers who can supply certificates rather than by remote attackers over the public internet, and proper mitigation relies on applying the vendor‑supplied patch or configuration changes to include multiple CRL handling.