Denial of Service in Systerel S2OPC

Executive Summary

CVE-2026-67872 is a denial-of-service vulnerability in Systerel S2OPC 1.7.3 caused by improper handling of monitored-item notification queues during resize operations. A remote attacker can exploit this by triggering events, creating a subscription with an event MonitoredItem, and then sending a ModifyMonitoredItems request to shrink the queue. This causes a NULL pointer dereference in the ModifyMonitoredItems function, crashing the server.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires checking for crashes in S2OPC servers when handling monitored item queues. Monitor server logs for segmentation faults or NULL pointer dereference errors during ModifyMonitoredItems operations. Inspect network traffic for repeated ModifyMonitoredItems requests targeting event MonitoredItems. Use tools like gdb to attach to the S2OPC process and observe crashes during queue resize operations.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows a remote attacker to crash the S2OPC server by sending specially crafted requests. The impact includes service disruption, potential loss of availability for OPC UA applications using S2OPC 1.7.3, and possible unauthorized access if the server fails to restart properly. Systems relying on this toolkit for industrial or critical infrastructure communication may experience downtime.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade S2OPC to a patched version that fixes the NULL pointer dereference in ModifyMonitoredItems. If upgrading is not immediately possible, restrict client access to ModifyMonitoredItems operations for event MonitoredItems. Implement rate limiting on ModifyMonitoredItems requests. Monitor server logs for suspicious activity and prepare to restart the server if crashes occur.

Useful 0 Not Useful 0