{"id":"CVE-2018-7559","aliases":["EUVD-2018-0604","GHSA-gr4c-5rq6-cgh3"],"status":"published","title":"OPC UA applications can allow a remote attacker to determine a Server's private key","description":"An issue was discovered in OPC UA .NET Standard Stack and Sample Code before GitHub commit 2018-04-12, and OPC UA .NET Legacy Stack and Sample Code before GitHub commit 2018-03-13. A vulnerability in OPC UA applications can allow a remote attacker to determine a Server's private key by sending carefully constructed bad UserIdentityTokens as part of an oracle attack.","severity":{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.01149,"percentile":0.67046,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-320"],"published":"2018-06-13T18:00:00Z","modified":"2026-10-20T10:50:50Z","fixes":[{"ecosystem":"NuGet","package":"OPCFoundation.NetStandard.Opc.Ua","fixed_in":["1.3.352.12"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"NuGet","package":"OPCFoundation.NetStandard.Opc.Ua","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.3.352.11"},{"fixed":"1.3.352.12"}]}]},{"source":"osv","ecosystem":"NuGet","package":"OPCFoundation.NetStandard.Opc.Ua","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.352.12"}]}],"versions":["0.4.0","0.4.1","0.4.3","0.4.4","0.4.5","1.3.348","1.3.349","1.3.350","1.3.350.1","1.3.350.3","1.3.350.4","1.3.350.5","1.3.350.6","1.3.351.7","1.3.352.10","1.3.352.11","1.3.352.9"]}],"products":[{"vendor":"opcfoundation","product":"ua-.net-legacy"},{"vendor":"opcfoundation","product":"ua-.netstandard"}],"references":[{"url":"https://opcfoundation-onlineapplications.org/faq/SecurityBulletins/OPC_Foundation_Security_Bulletin_CVE-2018-7559.pdf","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://github.com/OPCFoundation/UA-.NETStandard/commit/ebcf026a54dd0c9052cff009d96d827ac923d150","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://github.com/OPCFoundation/UA-.NET-Legacy/commit/e2a781b38efb8686d2bd850c2f2372b5c670bc45","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"http://www.securityfocus.com/bid/108688","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-7559","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-gr4c-5rq6-cgh3","tags":["advisory"]},{"url":"https://github.com/OPCFoundation/UA-.NETStandard","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2018-7559","description":"An issue was discovered in OPC UA .NET Standard Stack and Sample Code before GitHub commit 2018-04-12, and OPC UA .NET Legacy Stack and Sample Code before GitHub commit 2018-03-13. A vulnerability in OPC UA applications can allow a remote attacker to determine a Server's private key by sending carefully constructed bad UserIdentityTokens as part of an oracle attack.","status":"published","published":"2018-06-13T18:00:00Z","modified":"2024-08-05T06:31:04.545Z","updated_at":"2026-11-02T14:35:10.313768Z"}],"euvd":[{"id":"EUVD-2018-0604","description":"An issue was discovered in OPC UA .NET Standard Stack and Sample Code before GitHub commit 2018-04-12, and OPC UA .NET Legacy Stack and Sample Code before GitHub commit 2018-03-13. A vulnerability in OPC UA applications can allow a remote attacker to determine a Server's private key by sending carefully constructed bad UserIdentityTokens as part of an oracle attack.","status":"published","published":"2018-06-13T18:00:00Z","modified":"2024-08-05T06:31:04Z","updated_at":"2026-11-03T02:40:05.625439Z"}],"ghsa":[{"id":"GHSA-gr4c-5rq6-cgh3","title":"OPC UA applications can allow a remote attacker to determine a Server's private key ","description":"An issue was discovered in OPC UA .NET Standard Stack and Sample Code before GitHub commit 2018-04-12, and OPC UA .NET Legacy Stack and Sample Code before GitHub commit 2018-03-13. A vulnerability in OPC UA applications can allow a remote attacker to determine a Server's private key by sending carefully constructed bad UserIdentityTokens as part of an oracle attack.","status":"published","published":"2018-10-16T19:58:42Z","modified":"2023-01-09T05:03:07Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T14:36:04.396827Z"}],"nvd":[{"id":"CVE-2018-7559","description":"An issue was discovered in OPC UA .NET Standard Stack and Sample Code before GitHub commit 2018-04-12, and OPC UA .NET Legacy Stack and Sample Code before GitHub commit 2018-03-13. A vulnerability in OPC UA applications can allow a remote attacker to determine a Server's private key by sending carefully constructed bad UserIdentityTokens as part of an oracle attack.","status":"published","published":"2018-06-13T18:29:00.62Z","modified":"2026-06-17T02:03:22.213Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":3.5,"vector":"AV:N/AC:M/Au:S/C:P/I:N/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-320"],"updated_at":"2026-11-02T14:04:29.837913Z"}],"osv":[{"id":"CVE-2018-7559","description":"An issue was discovered in OPC UA .NET Standard Stack and Sample Code before GitHub commit 2018-04-12, and OPC UA .NET Legacy Stack and Sample Code before GitHub commit 2018-03-13. A vulnerability in OPC UA applications can allow a remote attacker to determine a Server's private key by sending carefully constructed bad UserIdentityTokens as part of an oracle attack.","status":"published","published":"2018-06-13T18:29:00.62Z","modified":"2026-10-20T10:50:50.886640223Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:09.74357Z"},{"id":"GHSA-gr4c-5rq6-cgh3","title":"OPC UA applications can allow a remote attacker to determine a Server's private key ","description":"An issue was discovered in OPC UA .NET Standard Stack and Sample Code before GitHub commit 2018-04-12, and OPC UA .NET Legacy Stack and Sample Code before GitHub commit 2018-03-13. A vulnerability in OPC UA applications can allow a remote attacker to determine a Server's private key by sending carefully constructed bad UserIdentityTokens as part of an oracle attack.","status":"published","published":"2018-10-16T19:58:42Z","modified":"2024-12-02T05:42:29.771247Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:46:48.191583Z"}]}}