Paper/Archive/CVE-2025-7390

CVE-2025-7390

Softing OPC UA C++ SDK — Bypass the client certificate trust check of an opc.https server while only secure communication is allowed

EPSS 0.3%CVSS 9.1

critical.is priorityof 100

CVSS 9.1 (CNA)9.1 / 10 × 3027.3 Not in CISA KEV+300.0 EPSS percentile 17.2.172 × 203.4 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

A malicious client can bypass the client certificate trust check of an opc.https server when the server endpoint is configured to allow only secure communication.

Affected

ProductAffectedFixed inSource

OPC UA C++ SDK6.40 – 6.806.80.1CNA

edgeConnector≤ 2025.03SDEX Suite V1.0CNA

edgeAggregator≤ 2025.03SDEX Suite V1.0CNA

Scores by source

Softing (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refindustrial.softing.com/fileadmin/psirt/downloads/2025/CVE-2025-7390.html refindustrial.softing.com/fileadmin/psirt/downloads/2025/CVE-2025-7390.json