CVE-2026-67870 in open62541
Riassunto
di MITRE • 06/08/2026
In open62541 v1.5.5, the server-side AddReferences implementation contains an incomplete validation flaw for non-local ExpandedNodeId targets. A remote attacker can send a crafted AddReferencesRequest with an empty targetServerUri and a non-zero targetNodeId.serverIndex, causing the target node pointer to remain NULL while execution continues.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.