CVE-2026-78049

Systerel S2OPC AddNodes Service sopc_node_mgt_helper_internal.c out-of-bounds

View on CVE.org
Published Aug 22, 2026 CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Description
A vulnerability has been found in Systerel S2OPC up to 1.7.3. Impacted is the function SOPC_NodeMgtHelperInternal_AddVariableNodeAttributes of the file src/ClientServer/address_space/internal/sopc_node_mgt_helper_internal.c of the component AddNodes Service. The manipulation of the argument UserAccessLevel leads to out-of-bounds read. It is possible to initiate the attack remotely. A high degree of complexity is needed for the attack. The exploitability is considered difficult. The exploit has been disclosed to the public and may be used. The identifier of the patch is aafbd37d381b618312ebdf5ddf57027f62c14fdd. It is suggested to install a patch to address this issue.

Analysis

AI-generated

Technical impact

The AddNodes service in Systerel S2OPC allows manipulation of the UserAccessLevel parameter to trigger an out‑of‑bounds read in the SOPC_NodeMgtHelperInternal_AddVariableNodeAttributes function. This flaw is capable of leaking memory contents beyond the expected buffer, providing a pathway for information disclosure when exploited remotely. While the current exploit requires significant complexity and is difficult to execute, the vulnerability has been publicly disclosed and could be leveraged by determined attackers.

Affected Systems

Systerel S2OPC versions up to 1.7.3 are affected. The vulnerability resides in the src/ClientServer/address_space/internal/sopc_node_mgt_helper_internal.c file of the AddNodes Service component. All builds based on those releases without the identified patch are susceptible.

Risk and Exploitability

The CVSS v3.1 score of 6.3 indicates moderate severity, and the lack of an EPSS rating means current data does not quantify exploitation probability. The flaw is not yet listed in CISA's KEV catalog. Attackers would need remote access to the AddNodes endpoint and considerable expertise to craft a payload that triggers the out‑of‑bounds read, yet the publicly disclosed nature of the vulnerability increases the risk of future exploitation. Systems exposed to untrusted inputs should consider immediate mitigation.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the vendor supplied patch identified by commit aafbd37d381b618312ebdf5ddf57027f62c14fdd.
  • Upgrade Systerel S2OPC to a version that incorporates the fix (version 1.7.4 or later).
  • Apply strict access controls around the AddNodes service and validate all UserAccessLevel inputs to prevent out-of-bound reads.

Generated by OpenCVE AI on August 22, 2026 at 23:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A vulnerability has been found in Systerel S2OPC up to 1.7.3. Impacted is the function SOPC_NodeMgtHelperInternal_AddVariableNodeAttributes of the file src/ClientServer/address_space/internal/sopc_node_mgt_helper_internal.c of the component AddNodes Service. The manipulation of the argument UserAccessLevel leads to out-of-bounds read. It is possible to initiate the attack remotely. A high degree of complexity is needed for the attack. The exploitability is considered difficult. The exploit has been disclosed to the public and may be used. The identifier of the patch is aafbd37d381b618312ebdf5ddf57027f62c14fdd. It is suggested to install a patch to address this issue.
Title Systerel S2OPC AddNodes Service sopc_node_mgt_helper_internal.c out-of-bounds
First Time appeared Systerel
Systerel s2opc
Weaknesses CWE-119
CWE-125
CPEs cpe:2.3:a:systerel:s2opc:*:*:*:*:*:*:*:*
Vendors & Products Systerel
Systerel s2opc
References
Metrics cvssV2_0

{'score': 2.6, 'vector': 'AV:N/AC:H/Au:N/C:N/I:N/A:P/E:POC/RL:OF/RC:C'}

cvssV3_0

{'score': 3.7, 'vector': 'CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C'}

cvssV3_1

{'score': 3.7, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C'}

cvssV4_0

{'score': 6.3, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-119

    Improper Restriction of Operations within the Bounds of a Memory Buffer

  • CWE-125

    Out-of-bounds Read

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Aug 27, 2026, 2:38 PM
Reserved
Aug 22, 2026, 7:44 AM

View source JSON

Updated
Aug 27, 2026, 1:27 PM

JSON

Status
Deferred
Published
Aug 22, 2026, 11:16 PM
Modified
Oct 12, 2026, 4:10 PM

View source JSON

No data.

Updated
Aug 22, 2026, 11:30 PM

JSON