National Institute of Standards and Technology (NIST) Reports Vulnerability in Components used in OmniServer OPC UA server interface

Reference IDs

NIST NVD (NIST Vulnerability Database): CVE-2021-45117, CVE-2021-3541

 

As of 21 March 2022, OmniServer V3.2.0.13 and newer is available to resolve these vulnerabilities in the OPC UA server interface. 

Full details are available in the NIST NVD entries available here:

It is important to understand that these vulnerability only affect OmniServer users who meet the following conditions:

If your OmniServer OPC UA server endpoints are either local only or are using any Security mode higher than None, the OmniServer installation should not be affected by this vulnerability. If the user changes ANY of the conditions, this statement is invalidated. Users are responsible for maintaining a secure environment consistent with their company's security standards and following their company change management practices. In absence of having company standards, users should consider US NIST guidelines.

If the conditions above are true, and the server is behind a secure firewall without any allowed access to the OmniServer OPC UA interface to individuals outside the company network, the attack surface is reduced but not to zero. The remaining vulnerability is from users who have physical access to the company's computers or networks. Each customer company must assess their security risk and stance and must involve their company Cyber-security professionals to assess the risk, and we can answer questions for those parties if needed. In absence of having company standards, users should consider US NIST guidelines.

For the affected versions, if a malicious actor gains access to your OmniServer application and performs a successful attack, you may experience a crash of OmniServer. The following is the range of possible potential impacts:

• Loss of ability to configure the application
• Loss of data 
• Loss of data acquisition 
• Loss of control of systems 

Software Toolbox has made available updates to the following set of more recent versions to address this issue that are available for download from the following links - your existing OmniServer configuration and protocols are fully compatible with this updated version. Please verify your current support/maintenance status in the OmniServer (Help -> About) prior to downloading and installing this updated version to confirm eligibility (keep reading below for next steps in situations where your support/maintenance period has expired).

It is also strongly recommended that you save a copy of your OmniServer configuration and protocols as a backup prior updating (See our FAQ for information about backing up and moving OmniServer configurations/protocols).

• Download OmniServer V3.2.0.13

Next Steps

For users with licenses covered by a current support/maintenance agreement:

1. You are eligible for any version up to and including the current version.
2. It is recommended to download V3.2.0.13 and upgrade your OmniServer installation as soon as practically possible, following your company's change management practices. Running the latest version is always recommended wherever possible.

For users with licenses NOT covered by a current support/maintenance agreement:

1. Please contact us for a quotation to reinstate your support/maintenance agreement. This will allow you to download V3.2.0.13 and upgrade your OmniServer installation as soon as practically possible, following your company's change management practices. Please include your serial number or any other information that will help us with your request.