Bypass the client certificate trust check of an opc.https server while only secure communication is allowed

The impact of CVE-2025-7390 is severe, particularly within industrial control systems (ICS) and operational technology (OT) environments. An attacker exploiting this vulnerability can effectively impersonate a legitimate client, gaining access to OPC UA servers without proper authentication. This could allow them to read sensitive process data, modify control parameters, or even disrupt operations entirely. The ability to bypass certificate validation represents a significant escalation of privilege, potentially granting an attacker complete control over targeted systems. This vulnerability shares similarities with other certificate validation bypasses, highlighting the importance of rigorous security practices in ICS deployments.

Organizations heavily reliant on industrial control systems (ICS) and operational technology (OT) using the OPC UA C++ SDK are at significant risk. This includes manufacturing plants, power grids, and other critical infrastructure sectors. Specifically, deployments using older versions of the SDK (6.40–SDEX Suite V1.0) and those with less stringent network security controls are particularly vulnerable.

• cpp / OPC UA: Use a network analyzer (Wireshark) to monitor OPC UA traffic and look for connections without valid client certificates. • cpp / OPC UA: Examine server logs for authentication failures related to certificate validation. • generic web: Monitor for unusual network traffic patterns originating from unauthorized clients attempting to connect to the OPC UA server. • generic web: Review firewall logs for attempts to bypass certificate validation.

1. 2025-08-21Disclosure

   disclosure

1. आरक्षित2025-07-09
2. प्रकाशित2025-08-21
3. संशोधित2026-03-27
4. EPSS अद्यतन2026-03-23

The primary mitigation for CVE-2025-7390 is to upgrade to a patched version of the OPC UA C++ SDK as soon as it becomes available. Until a patch is applied, consider implementing compensating controls to reduce the risk. These controls may include restricting network access to the OPC UA server, implementing strict firewall rules to limit client connections, and closely monitoring server logs for suspicious activity. Consider using a Web Application Firewall (WAF) to filter malicious requests. Verify that client certificates are properly configured and validated on the server side. After upgrading, confirm the fix by attempting a connection with an invalid certificate and verifying that it is rejected.