CVE-2022-33916: Exposure of Sensitive Information in OPCFoundation.NetStandard.Opc.Ua.Server
Summary
CVE-2022-33916: Exposure of Sensitive Information in OPCFoundation.NetStandard.Opc.Ua.Server. Affects OPCFoundation.NetStandard.Opc.Ua.Server versions < 1.4.370.9. Fixed in 1.4.370.9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OPCFoundation.NetStandard.Opc.Ua.Server is a NuGet package that provides an OPC UA .NET Standard Reference Server. It is used to implement OPC UA server functionality in .NET applications. OPC UA (Open Platform Communications Unified Architecture) is a machine-to-machine communication protocol for industrial automation. The package allows developers to create OPC UA servers that can communicate with OPC UA clients.
The vulnerability identified as CVE-2022-33916 exposes sensitive information in the OPCFoundation.NetStandard.Opc.Ua.Server package. This vulnerability can be exploited remotely, allowing an attacker to cause the application to access sensitive information.
Vulnerability Detail
The vulnerability in OPCFoundation.NetStandard.Opc.Ua.Server allows a remote attacker to cause the application to access sensitive information. The exact nature of the sensitive information is not specified in the vulnerability report. However, it is important to note that unauthorized access to sensitive information can lead to various security risks, including data breaches, unauthorized access to systems, and potential compromise of user privacy.
The vulnerability has a CVSS score of 5.3, indicating a moderate severity level. The vulnerability has been assigned the CVE identifier CVE-2022-33916 and has been reviewed by GitHub. The Common Weakness Enumeration (CWE) identifier associated with this vulnerability is CWE-200.
How To Fix
Latest published version: 2.0.1 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.4.370.9
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended approach is to update the package to the fixed version as mentioned in the 'how_to_fix' section.
Conclusion
The vulnerability in OPCFoundation.NetStandard.Opc.Ua.Server exposes sensitive information and can be exploited remotely. It is important to update the package to the fixed version to mitigate the risk of unauthorized access to sensitive information. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for OPCFoundation.NetStandard.Opc.Ua.Server →
FAQ
OPCFoundation.NetStandard.Opc.Ua.Server is a NuGet package that provides an OPC UA .NET Standard Reference Server. It is used to implement OPC UA server functionality in .NET applications.
OPC UA (Open Platform Communications Unified Architecture) is a machine-to-machine communication protocol for industrial automation.
The vulnerability allows a remote attacker to cause the application to access sensitive information. This can lead to security risks such as data breaches and unauthorized access to systems.
The vulnerability has a CVSS score of 5.3, indicating a moderate severity level.
To fix the vulnerability, it is recommended to update the OPCFoundation.NetStandard.Opc.Ua.Server package to version 1.4.370.9 or later.
Related vulnerabilities
Recent vulnerabilities recorded for OPCFoundation.NetStandard.Opc.Ua.Server.
