ICS Advisory: Integration Objects OPC UA Server Toolkit

Summary:

A vulnerability (CVE-2023-7234) has been identified in the OPC UA Server Toolkit, a software library used to create OPC DA, DX, and HDA servers. The vulnerability, rated CVSS v3.1 5.3, allows a remote attacker to add content to the log file by exploiting an improper output neutralization for logs. All versions of the OPC UA Server Toolkit are affected, and Integration Objects has not responded to requests to work with CISA to mitigate the issue. CISA recommends minimizing network exposure, isolating control system networks, and implementing secure remote access methods to protect against exploitation.