CVE-2023-29377: Softing OPC UA SDK Path Traversal Vulnerability

CVE-2023-29377 Overview

CVE-2023-29377 affects Softing OPC UA C++ SDK through version 6.20 and Softing Secure Integration Server through version 1.22. The vulnerability allows authenticated attackers to bypass path restrictions on FileDirectory and File OPC UA objects by using FileType renames. This weakness maps to [CWE-23] Relative Path Traversal, enabling arbitrary directory and file path assignment outside the intended scope.

Critical Impact
Attackers with high privileges can traverse the file system through OPC UA object rename operations, exposing confidentiality, integrity, and availability of files on affected industrial systems.

Affected Products

Softing OPC UA C++ SDK through 6.20
Softing Secure Integration Server through 1.22
Downstream OPC UA products embedding the affected SDK

Discovery Timeline

2026-09-14 - CVE-2023-29377 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2023-29377

Vulnerability Analysis

The vulnerability resides in how the Softing OPC UA C++ SDK enforces path restrictions on FileDirectory and File OPC UA object types. The SDK validates path assignments at creation time but fails to re-validate paths after a FileType rename operation. An authenticated OPC UA client can leverage the rename primitive to point objects at directories or files outside the sandboxed path scope.

The flaw is categorized as [CWE-23] Relative Path Traversal. Exploitation impacts industrial control environments that rely on Softing SDK components for OPC UA server functionality, including the Secure Integration Server used to bridge OT and IT networks.

Root Cause

The underlying defect is missing revalidation of path constraints during object rename. The SDK enforces the directory or file path allowlist only on the initial assignment. When a client subsequently renames a File or FileDirectory node, the new target path bypasses the original access control checks.

Attack Vector

Exploitation requires network access to the OPC UA endpoint and authenticated session credentials with high privileges. The attacker sends OPC UA method calls to rename a FileType node, redirecting it to an attacker-chosen path on the host file system. No user interaction is required. Refer to the Zero Day Initiative Advisory ZDI-23-1055 and the Softing Security Advisory Syt-2023-02 for protocol-level details.

No verified public proof-of-concept code is available. See the vendor and ZDI advisories for technical specifics.

Detection Methods for CVE-2023-29377

Indicators of Compromise

OPC UA audit log entries showing FileType rename operations targeting paths outside the configured FileDirectory scope.
Unexpected file reads or writes originating from the Softing OPC UA server process against system directories.
Authenticated OPC UA sessions from unusual source addresses invoking rename methods on File or FileDirectory nodes.

Detection Strategies

Enable OPC UA server-side auditing and forward events to a centralized SIEM for correlation of rename-then-access patterns.
Baseline legitimate FileType node paths and alert on deviations that reference parent-directory traversal sequences.
Monitor file system access by the Softing service account for reads or writes outside its documented working directories.

Monitoring Recommendations

Ingest Softing Secure Integration Server audit logs and Windows file system audit events into a centralized data lake for retention and correlation.
Alert on authenticated OPC UA sessions performing rename operations followed by file read or write calls within a short time window.
Track outbound file exfiltration attempts from OT hosts running the affected SDK.

How to Mitigate CVE-2023-29377

Immediate Actions Required

Inventory all deployments of Softing OPC UA C++ SDK and Secure Integration Server, identifying versions at or below 6.20 and 1.22 respectively.
Restrict network access to OPC UA endpoints to trusted management hosts using firewall rules or network segmentation.
Rotate and audit credentials for OPC UA accounts, especially those with high privileges required to invoke rename methods.
Apply the fixed versions published in the Softing Security Advisory Syt-2023-02.

Patch Information

Softing has released updated versions of the OPC UA C++ SDK and Secure Integration Server that enforce path validation on rename operations. Consult the Softing Security Advisory Syt-2023-02 JSON for fixed version numbers and download locations. Downstream vendors embedding the SDK must rebuild and redistribute their products with the patched library.

Workarounds

Disable the FileType rename capability on OPC UA servers where operational workflows do not require it.
Enforce least privilege on OPC UA user roles so that only necessary accounts hold rights to modify File or FileDirectory nodes.
Run the Softing service under a low-privilege OS account with a filesystem ACL that restricts access to a dedicated working directory.

bash

# Configuration example: restrict Softing service account file system scope
# Windows example using icacls to constrain the service account
icacls "C:\ProgramData\Softing\OPCUA\workdir" /inheritance:r
icacls "C:\ProgramData\Softing\OPCUA\workdir" /grant:r "SoftingSvc:(OI)(CI)M"
icacls "C:\" /deny "SoftingSvc:(OI)(CI)W"