CVE-2025-7390 Overview
A critical security vulnerability has been identified in OPC UA HTTPS server implementations that allows malicious clients to bypass client certificate trust verification. This certificate validation bypass flaw enables attackers to circumvent security controls on OPC UA server endpoints that are specifically configured to allow only secure, authenticated communications.
The vulnerability stems from improper certificate validation (CWE-295), where the OPC UA HTTPS server fails to properly verify client certificates during the TLS handshake process. This allows unauthorized clients to establish connections to secured endpoints without presenting valid, trusted certificates.
Critical Impact
Attackers can bypass authentication controls to gain unauthorized access to industrial control systems and OPC UA servers configured for secure-only communication, potentially compromising confidentiality and integrity of critical operational data.
Affected Products
- OPC UA HTTPS Server implementations with client certificate authentication
- Softing OPC UA products (refer to vendor advisory for specific versions)
- Industrial automation systems utilizing OPC UA secure endpoints
Discovery Timeline
- August 21, 2025 - CVE-2025-7390 published to NVD
- August 22, 2025 - Last updated in NVD database
Technical Details for CVE-2025-7390
Vulnerability Analysis
This vulnerability represents a fundamental failure in the certificate trust chain validation process within OPC UA HTTPS server implementations. When an OPC UA server endpoint is configured to require secure communication with client certificate authentication, the server should validate that connecting clients present certificates signed by a trusted Certificate Authority (CA) and that the certificates are valid (not expired, not revoked).
The flaw allows malicious actors to bypass this critical security control, enabling them to connect to secured endpoints without presenting a properly trusted certificate. This undermines the entire security model of OPC UA implementations that rely on certificate-based mutual authentication for access control.
The vulnerability affects the confidentiality and integrity of data transmitted through the compromised channel, as attackers can potentially read sensitive operational data and inject malicious commands into industrial control systems.
Root Cause
The vulnerability is classified under CWE-295 (Improper Certificate Validation). The root cause lies in the server's failure to properly implement certificate chain validation, trust anchor verification, or certificate revocation checks during the TLS/HTTPS handshake process. This implementation flaw allows clients presenting untrusted, self-signed, or otherwise invalid certificates to be incorrectly accepted by the server.
Attack Vector
The attack is network-based and requires no authentication or user interaction. An attacker with network access to the OPC UA HTTPS server endpoint can exploit this vulnerability remotely. The attack process involves:
- The attacker identifies an OPC UA HTTPS server endpoint configured for secure communication
- The attacker initiates a TLS connection using a self-signed or untrusted client certificate
- Due to the improper validation, the server accepts the connection despite the certificate not being trusted
- The attacker gains unauthorized access to the OPC UA server functionality
The vulnerability can be exploited to bypass certificate-based access controls without requiring valid credentials. For detailed technical analysis, refer to the Softing CVE-2025-7390 Advisory.
Detection Methods for CVE-2025-7390
Indicators of Compromise
- Unexpected client connections from IP addresses not associated with trusted systems
- TLS handshake completions with certificates not present in the server's trust store
- Authentication events showing connections from unknown or untrusted certificate subjects
- Anomalous OPC UA session establishment patterns without corresponding valid certificate presentations
Detection Strategies
- Monitor TLS handshake events and alert on connections with certificate validation warnings or errors that proceed to successful session establishment
- Implement certificate pinning monitoring to detect connections using certificates not explicitly trusted
- Deploy network intrusion detection rules to identify OPC UA HTTPS traffic patterns from unexpected sources
- Enable detailed logging of certificate validation decisions and review for anomalies
Monitoring Recommendations
- Enable verbose logging for certificate validation processes on OPC UA servers
- Implement real-time alerting for any certificate validation bypass or warning conditions
- Monitor OPC UA session establishment logs for connections from unrecognized certificate subjects
- Establish baseline network traffic patterns and alert on deviations in OPC UA endpoint communications
How to Mitigate CVE-2025-7390
Immediate Actions Required
- Review all OPC UA HTTPS server configurations to identify endpoints using client certificate authentication
- Implement network segmentation to restrict access to OPC UA endpoints to trusted network zones only
- Deploy additional authentication mechanisms as a defense-in-depth measure while awaiting patches
- Monitor OPC UA server logs for signs of unauthorized access attempts
Patch Information
Softing has released a security advisory addressing this vulnerability. Organizations should consult the Softing CVE-2025-7390 Advisory for specific patch information and update instructions for affected products.
Detailed vulnerability information in machine-readable format is available via the Softing JSON Advisory.
Workarounds
- Implement network access controls (firewalls, VLANs) to restrict OPC UA server access to trusted hosts only
- Enable IP-based allowlisting as an additional layer of access control
- Consider deploying a reverse proxy with proper certificate validation in front of affected OPC UA endpoints
- Disable client certificate authentication temporarily and use alternative authentication methods if available and appropriate for your security requirements
# Example: Network-level access restriction for OPC UA endpoints
# Restrict access to OPC UA HTTPS port (typically 4443) to trusted IP ranges
iptables -A INPUT -p tcp --dport 4443 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 4443 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
