This vulnerability (CVE-2025-11482) affects the OPC-UA Server in PPT30 Operating System versions prior to 1.8.0. It is classified as CWE-770, indicating allocation of resources without limits or throttling. An unauthenticated attacker can exploit this flaw remotely to exhaust resources, causing a denial of service that blocks legitimate user access. The CVSS 3.1 base score is 7.5, reflecting network attack vector, low attack complexity, no privileges or user interaction required, unchanged scope, no confidentiality or integrity impact, but high availability impact. No patch or official remediation level has been published by the vendor as of the data provided.

The vulnerability allows an unauthenticated remote attacker to cause a denial of service by exhausting resources in the OPC-UA Server, resulting in permanent disruption of service availability for legitimate users. There is no impact on confidentiality or integrity. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is released, users should consider limiting network exposure of the OPC-UA Server and applying any recommended vendor mitigations once available. Monitor official B&R Industrial Automation GmbH advisories for updates.