CVE-2024-42512 Overview
CVE-2024-42512 is an authentication bypass vulnerability in the OPC Foundation OPC UA .NET Standard Stack before version 1.5.374.158. The flaw allows an unauthorized network attacker to bypass application authentication when the deprecated Basic128Rsa15 security policy is enabled. The vulnerability is classified under [CWE-208] (Observable Timing Discrepancy) and impacts industrial automation environments that rely on OPC Unified Architecture (OPC UA) for machine-to-machine communication. Because OPC UA is widely deployed in operational technology (OT) and SCADA environments, the bypass exposes industrial control systems to unauthorized access.
Critical Impact
An unauthenticated remote attacker can bypass application authentication on OPC UA servers configured with the legacy Basic128Rsa15 policy, gaining access to industrial process data and control surfaces.
Affected Products
- OPC Foundation UA .NET Standard Stack versions prior to 1.5.374.158
- Applications and servers built using the vulnerable stack with the Basic128Rsa15 security policy enabled
- Industrial control and SCADA deployments depending on the affected stack for OPC UA communication
Discovery Timeline
- 2025-02-10 - CVE-2024-42512 published to the National Vulnerability Database
- 2025-09-29 - Last updated in NVD database
Technical Details for CVE-2024-42512
Vulnerability Analysis
The vulnerability resides in how the OPC UA .NET Standard Stack handles application authentication when the deprecated Basic128Rsa15 security policy is in use. OPC UA application authentication relies on cryptographic operations to validate that a connecting client possesses a trusted certificate and the corresponding private key. The CWE-208 classification points to an observable timing discrepancy that an attacker can leverage to defeat that validation. By measuring response timing variations, an attacker can infer enough information to bypass the authentication step without holding valid credentials.
The attack is network reachable, requires no privileges, and requires no user interaction. Successful exploitation grants application-level access to the OPC UA server, which in industrial environments typically exposes tag reads, writes, method calls, and subscription data.
Root Cause
The root cause is the continued use of the deprecated Basic128Rsa15 security policy combined with a cryptographic implementation that leaks timing information during authentication checks. Basic128Rsa15 relies on RSA with PKCS#1 v1.5 padding, which is known to be vulnerable to padding oracle and timing side-channel attacks. The OPC Foundation deprecated this policy years ago, but it remained available for backwards compatibility, leaving environments that explicitly enabled it exposed to authentication bypass.
Attack Vector
The attack vector is network based. An attacker who can reach the OPC UA endpoint over the network sends crafted authentication requests and analyzes timing characteristics in the server responses. By iteratively refining requests based on observed timing, the attacker bypasses the authentication checks tied to Basic128Rsa15. No user interaction is required, and the attacker does not need any prior credentials or session on the target system. Detailed technical descriptions are available in the OPC Foundation Security Bulletin CVE-2024-42512.
Detection Methods for CVE-2024-42512
Indicators of Compromise
- OPC UA server logs showing repeated authentication attempts from a single source within short time windows, consistent with timing analysis probing.
- Sessions established under the Basic128Rsa15 security policy from clients lacking matching certificates in the trust list.
- Unexpected reads, writes, or method calls on OPC UA nodes originating from previously unseen client application URIs.
Detection Strategies
- Inventory all OPC UA servers built on the .NET Standard Stack and identify those with versions below 1.5.374.158.
- Inspect server endpoint configurations and flag any endpoint advertising http://opcfoundation.org/UA/SecurityPolicy#Basic128Rsa15.
- Correlate network telemetry on OPC UA TCP port 4840 with authentication outcomes to surface brute-force or timing-style probing.
Monitoring Recommendations
- Forward OPC UA audit events to a centralized SIEM and alert on authentication failures followed by successful sessions from the same source.
- Monitor east-west OT network segments for new or unexpected OPC UA clients connecting to production servers.
- Track changes to OPC UA trust lists and certificate stores on affected hosts to detect tampering after a suspected bypass.
How to Mitigate CVE-2024-42512
Immediate Actions Required
- Upgrade the OPC UA .NET Standard Stack to version 1.5.374.158 or later across all affected applications and servers.
- Disable the Basic128Rsa15 security policy on every OPC UA endpoint and replace it with Basic256Sha256 or Aes256_Sha256_RsaPss.
- Restrict network access to OPC UA endpoints using firewall rules and network segmentation between IT and OT zones.
- Rotate and re-issue application instance certificates on systems where bypass activity is suspected.
Patch Information
The OPC Foundation has released a fixed version of the OPC UA .NET Standard Stack at 1.5.374.158. Maintainers of downstream applications must rebuild and redistribute their products against the patched stack. Refer to the OPC Foundation Security Bulletin CVE-2024-42512 for the authoritative version guidance and additional remediation notes.
Workarounds
- Where immediate patching is not possible, disable Basic128Rsa15 in the server configuration and require clients to use a modern security policy.
- Place vulnerable OPC UA servers behind an OPC UA gateway or aggregator that terminates client connections using a patched stack and stronger policies.
- Apply strict allow-listing of client application URIs and certificates so that only known industrial clients can initiate sessions.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
