[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fMXPqMcYtO_0iYYYcsA3qXvzaW3lu5IbnjHNqfuy_d-4":3},{"article":4,"iocs":44,"watch_terms":49,"solutions":50,"lesson":118},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":27,"category":28,"article_tags":31},"3bab2716-63c9-4778-891e-2ba90f84a6ab","OPCFoundation OPC UA LocalDiscoveryServer (LDS)","opcfoundation-opc-ua-localdiscoveryserver-lds-85284d","View CSAF Summary Successful exploitation of this vulnerability could allow an attacker to take control of a high-privilege terminal during installation and run arbitrary commands. The following versions of OPCFoundation OPC UA LocalDiscoveryServer (LDS) are affected: UA-LDS-Installers \u003C1.04.420 (CVE-2026-77477) CVSS Vendor Equipment Vulnerabilities v3 4.6 OPCFoundation OPCFoundation OPC UA LocalDiscoveryServer (LDS) Execution with Unnecessary Privileges Background Critical Infrastructure Sectors: Chemical, Energy, Food and Agriculture, Water and Wastewater, Critical Manufacturing Countries\u002FAreas Deployed: Worldwide Company Headquarters Location: United States Vulnerabilities Expand All + CVE-2026-77477 An attacker can intercept a high-privilege console window launched during installation of the LDS. The attacker must be able to launch an installer with elevated privileges and have access to the keyboard and display while the installation is taking place. View CVE Details Affected Products OPCFoundation OPC UA LocalDiscoveryServer (LDS) Vendor: OPCFoundation Product Version: OPCFoundation UA-LDS-Installers: \u003C1.04.420 Product Status: known_affected Remediations Mitigation OPCFoundation recommends users update to OPC UA LDS Installers 1.04.420 or later. Mitigation For more information about this vulnerability and its mitigation, see the OPCFoundation security advisory. https:\u002F\u002Fgithub.com\u002FOPCFoundation\u002FOPC-SecurityAdvisories\u002Ftree\u002Flatest\u002Fcsaf\u002F2026\u002F009 Relevant CWE: CWE-250 Execution with Unnecessary Privileges Metrics CVSS Version Base Score Base Severity Vector String 3.1 4.6 MEDIUM CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:L\u002FUI:R\u002FS:C\u002FC:L\u002FI:L\u002FA:N 4.0 2.4 LOW CVSS:4.0\u002FAV:L\u002FAC:L\u002FAT:N\u002FPR:L\u002FUI:P\u002FVC:L\u002FVI:L\u002FVA:N\u002FSC:L\u002FSI:L\u002FSA:N Acknowledgments Lukas Schumaker of Rockwell Automation reported this vulnerability to OPCFoundation. OPCFoundation reported this vulnerability to CISA. Legal Notice and Terms of Use This product is provided subject to this Notification (https:\u002F\u002Fwww.cisa.gov\u002Fnotification) and this Privacy & Use policy (https:\u002F\u002Fwww.cisa.gov\u002Fprivacy-policy). Recommended Practices CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures. CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov\u002Fics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies. CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov\u002Fics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies. Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents. CISA also recommends users take the following measures to protect themselves from social engineering attacks: Do not click web links or open attachments in unsolicited email messages. Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams. Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks. No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time. This vulnerability is not exploitable remotely. Revision History Initial Release Date: 2026-09-03 Date Revision Summary 2026-09-03 1 Initial Publication Legal Notice and Terms of Use","A vulnerability (CVE-2026-77477) in OPCFoundation's OPC UA LocalDiscoveryServer (LDS) installers, specifically versions prior to 1.04.420, allows attackers to execute arbitrary commands with high privileges during installation. Exploitation requires local access to the installer and the ability to interact with the console during the installation process. OPCFoundation recommends updating to version 1.04.420 or later.","OPC UA LocalDiscoveryServer (LDS) vulnerability allows arbitrary command execution during installation.","https:\u002F\u002Fwww.cisa.gov\u002Fnews-events\u002Fics-advisories\u002Ficsa-26-246-01",null,"2026-09-03T12:00:00+00:00","2026-09-03T18:00:31.080374+00:00",7,[17,20,23,25],{"name":18,"type":19},"OPC UA LocalDiscoveryServer (LDS)","product",{"name":21,"type":22},"OPCFoundation","vendor",{"name":24,"type":19},"UA-LDS-Installers",{"name":26,"type":22},"Rockwell Automation","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":27,"icon":12,"name":29,"slug":30},"Vulnerabilities","vulnerabilities",[32,37,39],{"category":33},{"id":34,"icon":12,"name":35,"slug":36},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":38},{"id":27,"icon":12,"name":29,"slug":30},{"category":40},{"id":41,"icon":12,"name":42,"slug":43},"d6f63bb8-0801-486a-be7f-171400700454","IoT\u002FOT","iot-ot",[45],{"type":46,"value":47,"context":48},"cve","CVE-2026-77477","Vulnerability in OPC UA LocalDiscoveryServer (LDS) installers",[21,26,18],{"controls":51,"vendors":117},[52,81,88],{"slug":53,"name":54,"problem":55,"products":56},"patch-management","Automated patch management","Known holes get closed in days, not months.",[57,65,73],{"vendor_slug":58,"vendor_name":59,"vendor_logo":60,"product_slug":61,"product_name":62,"url":63,"description":64},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":69,"product_name":70,"url":71,"description":72},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"slug":82,"name":83,"problem":84,"products":85},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",[86,87],{"vendor_slug":58,"vendor_name":59,"vendor_logo":60,"product_slug":61,"product_name":62,"url":63,"description":64},{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},{"slug":89,"name":90,"problem":91,"products":92},"ot-security","OT and industrial control system security","Factory, building and utility control systems get visibility and protection.",[93,101,109],{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"claroty","Claroty","\u002Fvendor-logos\u002Fclaroty.png","xdome","Claroty xDome","https:\u002F\u002Fclaroty.com\u002Findustrial-cybersecurity\u002Fxdome","Asset inventory, vulnerability management and threat detection for industrial networks.",{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-ot-security","Tenable OT Security","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fot-security","Asset inventory, vulnerability and threat detection for industrial networks.",{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":113,"product_name":114,"url":115,"description":116},"nozomi-networks","Nozomi Networks","\u002Fvendor-logos\u002Fnozomi-networks.png","guardian","Nozomi Networks Guardian","https:\u002F\u002Fwww.nozominetworks.com\u002Fplatform\u002Fguardian","Passive monitoring, asset inventory and threat detection for OT and IoT networks.",[],{"slug":119,"title":120,"body":121,"framework_refs":122,"framework_notes":132},"opc-ua-lds-installer-flaw-enables-privilege-escalation-via-local-access","OPC UA LDS Installer Flaw Enables Privilege Escalation via Local Access","A vulnerability in OPC Foundation's OPC UA LocalDiscoveryServer (LDS) installers prior to version 1.04.420 allows attackers with local access to execute arbitrary commands with elevated privileges during the installation process. The root cause lies in insufficient input validation and insecure handling of console interactions within the installer itself — a class of vulnerability often overlooked during software supply chain reviews. This is particularly significant in industrial and operational technology (OT) environments where OPC UA is widely deployed, as privilege escalation can lead to full system compromise. Organizations that delay patching installer components or fail to track third-party software versions are especially exposed. Prompt upgrades to version 1.04.420 or later are essential to close this attack vector.",[123,124,125,126,127,128,129,130,131],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 7: Continuous Vulnerability Management","CIS Control 4: Secure Configuration of Enterprise Assets","NIST SP 800-82: Guide to ICS\u002FOT Security","NIST SI-2: Flaw Remediation","NIST AC-6: Least Privilege","NIST CM-11: User-Installed Software","IEC 62443-3-3: System Security Requirements for Industrial Automation","ITIL Change Management: Controlled Software Deployment",{}]