CVE-2025-11482: PPT30 OPC-UA Server DoS Vulnerability

CVE-2025-11482 Overview

CVE-2025-11482 is a resource exhaustion vulnerability [CWE-770] affecting the OPC-UA Server component used in the PPT30 Operating System versions before 1.8.0. The flaw stems from improper allocation of resources without limits or throttling. An unauthenticated network-based attacker can exploit this weakness to permanently prevent legitimate users from interacting with the OPC-UA service. The vulnerability requires no privileges, no user interaction, and is reachable over the network.

Critical Impact
Remote unauthenticated attackers can cause a permanent denial of service against the OPC-UA Server, disrupting industrial communications until the service is manually restored.

Affected Products

PPT30 Operating System versions prior to 1.8.0
OPC-UA Server component shipped within affected PPT30 firmware
Industrial systems relying on the PPT30 OPC-UA interface for monitoring and control

Discovery Timeline

2026-05-26 - CVE-2025-11482 published to NVD
2026-05-26 - Last updated in NVD database

Technical Details for CVE-2025-11482

Vulnerability Analysis

The vulnerability resides in how the OPC-UA Server in PPT30 handles incoming network requests and associated resource allocations. The server fails to enforce limits or throttling on resource consumption, allowing an attacker to exhaust available capacity by submitting crafted or repeated requests. Because OPC-UA operates as a long-running industrial service, exhausted resources do not recover without operator intervention, resulting in a permanent denial of service.

The weakness is classified as [CWE-770] Allocation of Resources Without Limits or Throttling. The advisory notes the attack requires no authentication, making any device that can reach the OPC-UA endpoint a viable attack surface. See the Linode Security Advisory SA25P006 for vendor details.

Root Cause

The OPC-UA Server implementation does not enforce upper bounds on resources such as session counts, subscription handles, connection backlogs, or memory buffers tied to incoming requests. Without throttling or quota enforcement, repeated allocation requests deplete finite server resources and prevent legitimate clients from establishing or maintaining sessions.

Attack Vector

An unauthenticated attacker with network access to the OPC-UA Server port submits a high volume of session, subscription, or connection allocation requests. The server allocates resources for each request without rejecting or recycling stale allocations. Once the resource pool is exhausted, the service permanently refuses new clients and stops responding to existing ones until a manual restart or firmware update is applied.

No verified exploit code is publicly available. Refer to the vendor advisory for technical specifics on the affected protocol interactions.

Detection Methods for CVE-2025-11482

Indicators of Compromise

Sudden loss of OPC-UA client connectivity to PPT30 devices without operator action
Spikes in inbound TCP connections to OPC-UA listener ports (typically 4840) from a single or small set of sources
Repeated session creation requests followed by absent session activation or normal teardown
PPT30 device logs showing exhausted session, subscription, or memory counters

Detection Strategies

Monitor OPC-UA endpoints for abnormal rates of CreateSession, CreateSubscription, or OpenSecureChannel service calls
Alert on OPC-UA Server unresponsiveness or watchdog failures within operational technology (OT) environments
Correlate network flow telemetry against expected OPC-UA client inventories to flag unknown source addresses
Track firmware version inventory to surface PPT30 devices running versions earlier than 1.8.0

Monitoring Recommendations

Enable network intrusion detection signatures for OPC-UA protocol anomalies and high-frequency session creation
Forward PPT30 device logs and OT network telemetry to a centralized SIEM for correlation
Establish baseline OPC-UA session counts per device and alert on deviations
Continuously inventory OT assets and their firmware levels to identify unpatched PPT30 systems

How to Mitigate CVE-2025-11482

Immediate Actions Required

Upgrade affected PPT30 Operating System installations to version 1.8.0 or later
Restrict network access to OPC-UA Server endpoints using firewalls and OT network segmentation
Allowlist only authorized OPC-UA client IP addresses at perimeter and segmentation points
Review and remove any unnecessary exposure of OPC-UA ports to untrusted networks or the internet

Patch Information

The vendor has addressed the issue in PPT30 Operating System version 1.8.0. Operators should consult the Linode Security Advisory SA25P006 for upgrade instructions and verify firmware integrity after deployment.

Workarounds

Place PPT30 devices behind an OT-aware firewall that rate-limits OPC-UA traffic until patches are applied
Disable the OPC-UA Server on PPT30 systems where the service is not operationally required
Use VPN or zero-trust gateways to require client authentication before reaching the OPC-UA endpoint
Schedule periodic service restarts as a temporary measure while patch deployment is planned

bash

# Example: restrict OPC-UA (TCP/4840) to a trusted management subnet
iptables -A INPUT -p tcp --dport 4840 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 4840 -j DROP