description: Prosys OPC UA Simulation Server version prior to v5.3.0-64 and UA Modbus Server versions 1.4.18-5 and prior do not sufficiently protect credentials, which could allow an attacker to obtain user credentials and gain access to system data.
problem types: CWE-522 Insufficiently Protected Credentials
affected:
{
defaultStatus: unaffected
product: UA Simulation Server
vendor: Prosys OPC
versions:
lessThan: 5.3.0-64, status: affected, version: 0, versionType: custom
}
{
defaultStatus: unaffected
product: UA Modbus Server
vendor: Prosys OPC
versions:
lessThanOrEqual: 1.4.18-5, status: affected, version: 0, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL
solutions: Prosys has released updates for the following products:
•  UA Simulation Server: Update to v5.4.0
•  UA Modbus Server: Update to 1.4.20
workarounds: Prosys also recommends additional workarounds to mitigate exploitation of this vulnerability:
*  Restart the application after modifying user passwords.
For more information, users can refer to the Prosys OPC  security blog https://www.prosysopc.com/blog/#Security .