CyberRota Analysis
AI-GeneratedEclipse Milo versions 1.0.0 through 1.1.4 are vulnerable due to a flaw in the `OpcUaServerConfig.copy()` method, which fails to retain the configured `RoleMapper`. This oversight can lead to unauthorized access, allowing anonymous clients to read sensitive role-permission metadata and invoke or delete protected resources. Organizations using these versions of Eclipse Milo, particularly those implementing role-based access controls, should prioritize addressing this vulnerability to mitigate potential security risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
In Eclipse Milo versions 1.0.0 through 1.1.4, `OpcUaServerConfig.copy()` fails to preserve a configured `RoleMapper`. On servers that rely on role permissions and construct the running configuration through `copy()`, sessions receive no role IDs and the default access controller skips role-permission checks, allowing an anonymous client where anonymous sessions are permitted to read role-permission metadata, invoke protected methods, or delete protected nodes.
Related CVEs
Other vulnerabilities affecting the same vendor(s)