« Volver al listado

CVE-2026-6899

Estado: AplazadaMedia (5.6)—

Check for certificate revocation only considers the first matching CRL and ignores other valid CRLs of the same CA in the CycloneCrypto cryptographic wrapper of S2OPC library. It might allow connection between an OPC UA client and server using a revoked certificate.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Cyclonecrypto — CyclonecryptoAIS2opc — S2opcAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-6899",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-6899",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-06-09T14:25:36.868407Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "cve@gitlab.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.6,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "LOW",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 3.4,
        "exploitabilityScore": 2.2
      }
    ]
  },
  "affected": [
    {
      "source": "cve@gitlab.com",
      "affectedData": [
        {
          "vendor": "Systerel",
          "product": "S2OPC",
          "versions": [
            {
              "status": "affected",
              "version": "1.5.0",
              "lessThan": "1.7.3",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-06-09T09:16:30.737",
  "references": [
    {
      "url": "https://gitlab.com/systerel/S2OPC/-/work_items/1739",
      "source": "cve@gitlab.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cve@gitlab.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-299"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Check for certificate revocation only considers the first matching CRL and ignores other valid CRLs of the same CA in the CycloneCrypto cryptographic wrapper of S2OPC library. It might allow connection between an OPC UA client and server using a revoked certificate."
    },
    {
      "lang": "es",
      "value": "La verificación de revocación de certificados solo considera la primera CRL coincidente e ignora otras CRL válidas de la misma CA en el envoltorio criptográfico CycloneCrypto de la biblioteca S2OPC. Podría permitir la conexión entre un cliente OPC UA y un servidor utilizando un certificado revocado."
    }
  ],
  "lastModified": "2026-07-23T08:10:00.137",
  "sourceIdentifier": "cve@gitlab.com"
}