An improper comparison against the trusted certificate list in Systerel’s S2OPC allows a well‑formed untrusted certificate to be treated as trusted. The flaw is an input validation error (CWE‑295) that lets an attacker masquerade as a legitimate identity, potentially enabling impersonation or unauthorized data access in applications that rely on S2OPC for secure communication. The change in trust status does not in itself decrypt data but it undermines the authentication layer that protects confidentiality, integrity, and availability of the OPC UA connection.

Systerel S2OPC versions up to and including 1.7.2 are affected. The vendor recommends upgrading to any release newer than 1.7.2 to obtain the fix.

The CVSS score of 7.3 indicates a high severity that could be exploited remotely. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting that widespread exploitation has not yet been observed. However, because the flaw is exploitable by simply presenting a forged certificate over the network, the likely attack vector is remote network interaction with a S2OPC host. An attacker who can inject or supply a certificate during the TLS or OPC UA handshake could bypass authentication and gain unauthorized access to protected resources.