CVE-2024-10085: OPC UA Platform DOS Vulnerability

CVE-2024-10085 Overview

CVE-2024-10085 is a denial-of-service vulnerability affecting an OPC UA communication platform. The flaw is classified as [CWE-770] Allocation of Resources Without Limits or Throttling. An unauthenticated remote attacker can flood the platform with a large volume of OPC UA requests. The platform fails to throttle or bound resource allocation, exhausting available capacity and disrupting communication services.

The issue was disclosed in a Schneider Electric security notice. Because OPC UA is widely used in industrial control and SCADA environments, an outage of the communication platform can propagate to downstream operational technology assets that depend on it for telemetry and control messaging.

Critical Impact
Unauthenticated network attackers can disrupt OPC UA communications, breaking data exchange between industrial controllers and supervisory systems.

Affected Products

Schneider Electric OPC UA communication platform (see vendor advisory for specific product versions)
Industrial control and SCADA deployments relying on the affected OPC UA server
Operational technology environments integrating with the platform for telemetry

Discovery Timeline

2026-09-01 - CVE-2024-10085 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2024-10085

Vulnerability Analysis

The vulnerability resides in how the OPC UA communication platform handles incoming client requests. The service accepts and processes OPC UA messages without enforcing an upper bound on concurrent sessions, message rate, or memory allocated per connection. Attackers can send a sustained burst of OPC UA requests to consume server-side resources.

OPC UA typically operates over TCP port 4840 using the binary protocol. Each session, subscription, or monitored item consumes memory and processing cycles on the server. When request volume exceeds design limits and no throttling is applied, threads block, buffers fill, and the platform stops servicing legitimate clients.

The result is an availability impact on the OPC UA layer. Confidentiality and integrity are not affected, but industrial workflows that depend on real-time OPC UA data exchange can stall until the platform is restarted or the flood stops.

Root Cause

The root cause is the absence of resource governors on the OPC UA request path. The platform does not cap the number of open sessions per client, does not rate-limit inbound requests, and does not enforce quotas on memory or CPU consumed per connection. This is a classic [CWE-770] pattern in network-facing services.

Attack Vector

Exploitation requires network reachability to the OPC UA endpoint and no authentication. An attacker generates a high volume of OPC UA requests, such as repeated CreateSession, CreateSubscription, or Read calls, using standard OPC UA client libraries or a scripted TCP client. Sustained request volume drives the platform into resource exhaustion.

No authenticated code execution or user interaction is required. The attack is protocol-native, so it blends with legitimate OPC UA traffic on port 4840.

No verified public proof-of-concept code is available. See the Schneider Electric Security Notice for vendor-specific technical details.

Detection Methods for CVE-2024-10085

Indicators of Compromise

Sudden spikes in inbound connections to TCP port 4840 or the configured OPC UA endpoint
High rates of CreateSession, CreateSubscription, or ActivateSession messages from a single source or small set of sources
OPC UA clients reporting timeouts, dropped subscriptions, or failure to reconnect
Rising CPU, memory, or thread count on the host running the OPC UA server without a corresponding workload change

Detection Strategies

Baseline normal OPC UA session counts and request rates, then alert on deviations that exceed defined thresholds
Correlate network flow data for port 4840 with server-side process metrics to identify request floods
Monitor OPC UA server logs for repeated session creation failures and audit events indicating resource exhaustion

Monitoring Recommendations

Forward OPC UA server logs and host telemetry into a centralized SIEM for correlation with network events
Instrument industrial DMZ firewalls to log and alert on burst traffic to OPC UA endpoints
Track application-level metrics such as active sessions, subscription counts, and queue depth on the OPC UA broker

How to Mitigate CVE-2024-10085

Immediate Actions Required

Restrict network access to the OPC UA endpoint so that only known engineering and SCADA hosts can reach TCP port 4840
Place the OPC UA platform behind an industrial firewall or data diode enforcing per-source connection limits
Review vendor advisories and inventory affected Schneider Electric OPC UA deployments

Patch Information

Refer to the Schneider Electric Security Notice SEVD-2025-287-01 for the current list of fixed versions, remediation steps, and product-specific mitigations. Apply vendor-supplied firmware or software updates on affected assets during a scheduled maintenance window.

Workarounds

Enforce network segmentation between the OPC UA platform and general-purpose IT networks
Configure firewall rate limits and per-source connection caps for traffic destined to OPC UA endpoints
Require OPC UA clients to authenticate and use secure channels where the platform supports it
Monitor and alert on abnormal session creation rates so operators can block source addresses quickly

bash

# Example iptables rate limit for OPC UA endpoint (port 4840)
iptables -A INPUT -p tcp --dport 4840 -m state --state NEW \
  -m recent --set --name OPCUA
iptables -A INPUT -p tcp --dport 4840 -m state --state NEW \
  -m recent --update --seconds 10 --hitcount 20 --name OPCUA -j DROP