Softing vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2025-10685 Heap-based buffer overflow vulnerability in Softing Industrial Automation GmbH smartLink SW-PN and smartLink SW-HT (Webserver modules) allows overflow buffers.THigh 7.7 · Mar 16, 2026
• CVE-2025-7390 A malicious client can bypass the client certificate trust check of an opc.https server when the server endpoint is configured to allow only secure communicatioCritical 9.1 · Aug 21, 2025
• CVE-2023-39481 Softing Secure Integration Server Interpretation Conflict Remote Code Execution Vulnerability.High 8.8 · May 2, 2024
• CVE-2023-39479 Softing Secure Integration Server OPC UA Gateway Directory Creation Vulnerability.High 8.8 · May 2, 2024
• CVE-2023-39478 Softing Secure Integration Server Exposure of Resource to Wrong Sphere Remote Code Execution Vulnerability.High 8.8 · May 2, 2024
• CVE-2023-38125 Softing edgeAggregator Permissive Cross-domain Policy with Untrusted Domains Remote Code Execution Vulnerability.High 8.8 · May 2, 2024
• CVE-2023-27336 Softing edgeConnector Siemens OPC UA Server Null Pointer Dereference Denial-of-Service Vulnerability.High 7.5 · May 2, 2024
• CVE-2023-27335 Softing edgeAggregator Client Cross-Site Scripting Remote Code Execution Vulnerability.Critical 9.6 · May 2, 2024
• CVE-2023-27334 Softing edgeConnector Siemens ConditionRefresh Resource Exhaustion Denial-of-Service Vulnerability.High 7.5 · May 2, 2024
• CVE-2024-0860 The affected product is vulnerable to a cleartext transmission of sensitive information vulnerability, which may allow an attacker to capture packets to craft High 8 · Mar 14, 2024
• CVE-2023-38126 Softing edgeAggregator Restore Configuration Directory Traversal Remote Code Execution Vulnerability.High 7.2 · Dec 19, 2023
• CVE-2023-41151 An uncaught exception issue discovered in Softing OPC UA C++ SDK before 6.30 for Windows operating system may cause the application to crash when the server wanHigh 7.5 · Dec 14, 2023
• CVE-2023-37572 Softing OPC Suite version 5.25 and before has Incorrect Access Control, allows attackers to obtain sensitive information via weak permissions in OSF_discovery sHigh 7.5 · Dec 5, 2023
• CVE-2022-48192 Cross-site Scripting vulnerability in Softing smartLink SW-HT before 1.30, which allows an attacker to execute a dynamic script (JavaScript, VBScript) in the coHigh 7.2 · Nov 6, 2023
• CVE-2022-45920 In Softing uaToolkit Embedded before 1.41, a malformed CreateMonitoredItems request may cause a memory leak.High 7.5 · Jan 26, 2023
• CVE-2022-44018 In Softing uaToolkit Embedded before 1.40.1, a malformed PubSub discovery announcement message can cause a NULL pointer dereference or out-of-bounds memory acceHigh 7.5 · Jan 26, 2023
• CVE-2022-39823 An issue was discovered in Softing OPC UA C++ SDK 5.66 through 6.x before 6.10.High 7.5 · Oct 20, 2022
• CVE-2022-37453 An issue was discovered in Softing OPC UA C++ SDK before 6.10.High 7.5 · Oct 20, 2022
• CVE-2022-2547 A crafted HTTP packet without a content-type header can create a denial-of-service condition in Softing Secure Integration Server V1.22.High 7.5 · Aug 17, 2022
• CVE-2022-2337 A crafted HTTP packet with a missing HTTP URI can create a denial-of-service condition in Softing Secure Integration Server V1.22.High 7.5 · Aug 17, 2022
• CVE-2022-2336 Softing Secure Integration Server, edgeConnector, and edgeAggregator software ships with the default administrator credentials as `admin` and password as `adminCritical 9.8 · Aug 17, 2022
• CVE-2022-2335 A crafted HTTP packet with a -1 content-length header can create a denial-of-service condition in Softing Secure Integration Server V1.22.High 7.5 · Aug 17, 2022
• CVE-2022-2334 The application searches for a library dll that is not found.High 7.2 · Aug 17, 2022
• CVE-2022-1748 Softing OPC UA C++ Server SDK, Secure Integration Server, edgeConnector, edgeAggregator, OPC Suite, and uaGate are affected by a NULL pointer dereference vulnerHigh 7.5 · Aug 17, 2022
• CVE-2022-1373 The “restore configuration” feature of Softing Secure Integration Server V1.22 is vulnerable to a directory traversal vulnerability when processing zip files.High 7.2 · Aug 17, 2022