CVE-2024-10085: CWE-770 Allocation of resources without limits or throttling in Schneider Electric EcoStruxure™ OPC UA Server Expert

This vulnerability, classified as CWE-770, arises from the EcoStruxure OPC UA Server Expert's failure to limit or throttle resource allocation when processing OPC UA requests. An attacker can exploit this by overwhelming the server with numerous requests, leading to denial of service of the OPC UA communication platform. The CVSS 4.0 base score is 8.2, indicating high severity with network attack vector, low attack complexity, no privileges or user interaction required, and high impact on availability. There is no vendor advisory or patch information currently available, and no known exploits in the wild have been reported.

Successful exploitation results in denial of service of the OPC UA communication platform, disrupting normal operations and potentially impacting industrial or automation processes relying on this server. Confidentiality, integrity, and other security properties are not impacted according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider limiting exposure of the OPC UA Server Expert to untrusted networks and monitoring for unusual request volumes to mitigate risk.