{"id":"CVE-2020-29457","aliases":["EUVD-2021-2369","GHSA-mjww-934m-h4jw"],"status":"published","title":"Improper Certificate Validation in OPCFoundation.NetStandard.Opc.Ua.Core","description":"A Privilege Elevation vulnerability in OPC UA .NET Standard Stack 1.4.363.107 could allow a rogue application to establish a secure connection.","severity":{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.00311,"percentile":0.24243,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-295"],"published":"2021-02-16T19:19:19Z","modified":"2026-10-20T10:53:14Z","fixes":[{"ecosystem":"NuGet","package":"OPCFoundation.NetStandard.Opc.Ua.Core","fixed_in":["1.4.365.10"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"NuGet","package":"OPCFoundation.NetStandard.Opc.Ua.Core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.4.365.2"},{"fixed":"1.4.365.10"}]}]},{"source":"osv","ecosystem":"NuGet","package":"OPCFoundation.NetStandard.Opc.Ua.Core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.365.10"}]}],"versions":["0.0.3","0.0.6","0.0.7","0.0.8","0.0.9","0.1.0","0.1.1","0.1.2","0.1.3","0.1.5","0.1.6","0.1.7","0.1.8","0.1.9","0.2.0","0.2.1","0.2.2","0.2.3","0.2.4","1.4.363.104-preview","1.4.363.107","1.4.364.40","1.4.365-gfc341ee8c5","1.4.365.1-preview","1.4.365.2"]}],"products":[{"vendor":"opcfoundation","product":"ua-.netstandard"}],"references":[{"url":"https://github.com/OPCFoundation/UA-.NETStandard","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://www.nuget.org/packages/OPCFoundation.NetStandard.Opc.Ua/","tags":["x_refsource_MISC","x_transferred","Product","Third Party Advisory","advisory"]},{"url":"https://opcfoundation.org/SecurityBulletins/OPC%20Foundation%20Security%20Bulletin%20CVE-2020-29457.pdf","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-29457","tags":["advisory"]},{"url":"https://github.com/OPCFoundation/UA-.NETStandard/pull/1229","tags":["web"]},{"url":"https://github.com/OPCFoundation/UA-.NETStandard/pull/1229/commits/d815cfb972bd668c1b6e461f6ff97519d6b26f25","tags":["web"]},{"url":"https://github.com/advisories/GHSA-mjww-934m-h4jw"},{"url":"https://www.nuget.org/packages/OPCFoundation.NetStandard.Opc.Ua","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2020-29457","description":"A Privilege Elevation vulnerability in OPC UA .NET Standard Stack 1.4.363.107 could allow a rogue application to establish a secure connection.","status":"published","published":"2021-02-16T19:19:19Z","modified":"2024-08-04T16:55:09.676Z","updated_at":"2026-11-02T14:35:55.460269Z"}],"euvd":[{"id":"EUVD-2021-2369","description":"A Privilege Elevation vulnerability in OPC UA .NET Standard Stack 1.4.363.107 could allow a rogue application to establish a secure connection.","status":"published","published":"2021-02-16T19:19:19Z","modified":"2024-08-04T16:55:09Z","updated_at":"2026-11-03T03:07:07.919663Z"}],"ghsa":[{"id":"GHSA-mjww-934m-h4jw","title":"Improper Certificate Validation in OPCFoundation.NetStandard.Opc.Ua.Core","description":"A Privilege Elevation vulnerability in OPC UA .NET Standard Stack 1.4.363.107 allows attackers to establish a connection using invalid certificates.","status":"published","published":"2021-11-19T20:19:53Z","modified":"2023-01-29T05:04:25Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T14:36:25.835323Z"}],"nvd":[{"id":"CVE-2020-29457","description":"A Privilege Elevation vulnerability in OPC UA .NET Standard Stack 1.4.363.107 could allow a rogue application to establish a secure connection.","status":"published","published":"2021-02-16T20:15:15.707Z","modified":"2026-06-17T03:11:18.537Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":2.1,"vector":"AV:L/AC:L/Au:N/C:N/I:P/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T14:06:34.188486Z"}],"osv":[{"id":"CVE-2020-29457","description":"A Privilege Elevation vulnerability in OPC UA .NET Standard Stack 1.4.363.107 could allow a rogue application to establish a secure connection.","status":"published","published":"2021-02-16T20:15:15.707Z","modified":"2026-10-20T10:53:14.760302905Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:16.612899Z"},{"id":"GHSA-mjww-934m-h4jw","title":"Improper Certificate Validation in OPCFoundation.NetStandard.Opc.Ua.Core","description":"A Privilege Elevation vulnerability in OPC UA .NET Standard Stack 1.4.363.107 allows attackers to establish a connection using invalid certificates.","status":"published","published":"2021-11-19T20:19:53Z","modified":"2024-02-22T05:33:30.362772Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T15:46:51.811331Z"}]}}