CVE-2026-9758: Improper Certificate Validation in S2OPC

Synopsis

Improper certificate validation in Systerel S2OPC (versions 1.5.0 through below 1.7.3) allows a network-accessible attacker to present a well-formed but untrusted certificate that the server incorrectly accepts as trusted. No authentication or user interaction is needed to exploit this flaw, since the bypass occurs during the TLS/OPC UA handshake itself. Successful exploitation gives the attacker read, write, and disruption access to resources protected by that certificate trust boundary. A patched-image rebuild at version 1.7.3 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the S2OPC service over the network; the vulnerability is exposed on any network-accessible endpoint running an affected version.

• AuthenticationNot required

  No credentials are needed; the certificate substitution occurs before any authenticated session is established.

• Victim interactionNot required

  No user or operator action is required; the attacker initiates the connection and the bypass is handled entirely by the server.

• Attack complexityDetail

  Attack complexity is low; the exploit requires only a well-formed certificate and no race conditions, memory layout knowledge, or special environmental conditions.

Blast Radius

• An attacker accepted as a trusted peer can read data exposed on the OPC UA session, including sensor readings, process values, and any application-layer telemetry the server exposes.
• The attacker can write values or issue commands permitted to the impersonated certificate identity, potentially modifying control-system state or configuration.
• The attacker can send malformed or high-volume requests that disrupt service availability for legitimate clients connected to the same endpoint.