CVE-2024-45526
Security Update for the OPC UA .NET Standard Stack
An issue was discovered in OPC Foundation OPCFoundation/UA-.NETStandard through 1.5.374.78. A remote attacker can send requests with invalid credentials and cause the server performance to degrade gradually.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
An issue was discovered in OPC Foundation OPCFoundation/UA-.NETStandard through 1.5.374.78. A remote attacker can send requests with invalid credentials and cause the server performance to degrade gradually.
- Record
CVE-2024-45526- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-770
- Updated
- 2026-11-02
EUVDEUVD-2024-2986
An issue was discovered in OPC Foundation OPCFoundation/UA-.NETStandard through 1.5.374.78. A remote attacker can send requests with invalid credentials and cause the server performance to degrade gradually.
- Record
EUVD-2024-2986- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-7vfh-cqpc-4267
Security Update for the OPC UA .NET Standard Stack
This security update resolves a vulnerability in the OPC UA .NET Standard Stack that allows an unauthorized attacker to trigger a gradual degradation in performance.
- Record
GHSA-7vfh-cqpc-4267- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-770
- Updated
- 2026-11-02
NVD
An issue was discovered in OPC Foundation OPCFoundation/UA-.NETStandard through 1.5.374.78. A remote attacker can send requests with invalid credentials and cause the server performance to degrade gradually.
- Record
CVE-2024-45526- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-770
- Updated
- 2026-11-02
OSVGHSA-7vfh-cqpc-4267
Security Update for the OPC UA .NET Standard Stack
This security update resolves a vulnerability in the OPC UA .NET Standard Stack that allows an unauthorized attacker to trigger a gradual degradation in performance.
- Record
GHSA-7vfh-cqpc-4267- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-770
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
OPCFoundation.NetStandard.Opc.UaNuGet |
before 1.5.374.118 | 1.5.374.118 |
OPCFoundation.NetStandard.Opc.Ua.CoreNuGet |
before 1.5.374.118 | 1.5.374.118 |
OPCFoundation.NetStandard.Opc.UaNuGet |
before 1.5.374.118, plus listed versions 0.4.00.4.10.4.30.4.40.4.5 Show 45 moreShow less1.3.3481.3.3491.3.3501.3.350.11.3.350.31.3.350.41.3.350.51.3.350.61.3.351.71.3.352.101.3.352.111.3.352.121.3.352.91.4.353.131.4.353.141.4.353.151.4.354.16-preview1.4.354.18-preview1.4.354.19-preview1.4.354.20-preview1.4.354.211.4.354.231.4.355.24-preview1.4.355.251.4.355.261.4.356.271.4.357.281.4.358.29-preview1.4.358.301.4.359.311.4.360.331.4.360.341.4.361.381.4.361.391.4.362.40-preview1.4.362.41-preview1.4.362.421.4.363.104-preview1.4.363.1071.4.363.47-preview1.4.363.48-preview1.4.363.491.4.364.401.4.365.1-preview1.4.365.10 |
1.5.374.118 |
OPCFoundation.NetStandard.Opc.Ua.CoreNuGet |
before 1.5.374.118, plus listed versions 0.0.30.0.60.0.70.0.80.0.9 Show 45 moreShow less0.1.00.1.10.1.20.1.30.1.50.1.60.1.70.1.80.1.90.2.00.2.10.2.20.2.30.2.41.4.363.104-preview1.4.363.1071.4.364.401.4.365-gfc341ee8c51.4.365.1-preview1.4.365.101.4.365.21.4.365.231.4.365.481.4.366.31-preview1.4.366.381.4.367.1001.4.367.391.4.367.411.4.367.421.4.367.64-preview1.4.367.751.4.367.951.4.368.27-preview1.4.368.331.4.368.52-preview1.4.368.531.4.368.581.4.369.301.4.370.11.4.370.121.4.370.91.4.371.411.4.371.501.4.371.601.4.371.86 |
1.5.374.118 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-45526 is a medium vulnerability (CVSS 5.3) in Opcfoundation Ua-.netstandard, published October 18, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.50%, the 43rd percentile. Fixed in OPCFoundation.NetStandard.Opc.Ua 1.5.374.118.
References
files.opcfoundation.org/SecurityBulletins/OPC%20Foundation%20Security%20Bulletin%20CVE-2024-45526.pdf
github.com/OPCFoundation/UA-.NETStandard/security/advisories/GHSA-7vfh-cqpc-4267
nvd.nist.gov/vuln/detail/CVE-2024-45526
Left out here: 85 versions. The JSON record has them.