B&R PPT30 OPC-UA denial-of-service via resource exhaustion
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Unauthenticated attacker can exhaust OPC-UA server resources in B&R PPT30 <1.8.0, denying service to legitimate users.
CVE-2025-11482 is a resource exhaustion vulnerability in the OPC-UA server component of B&R PPT30 Operating System versions before 1.8.0. An unauthenticated network-based attacker with access to the affected system can send specially crafted messages that exhaust server resources, permanently preventing legitimate users from connecting to the OPC-UA service. This affects industrial control systems deployed across critical sectors including energy, water, manufacturing, transportation, and commercial facilities worldwide. The OPC-UA server is not enabled by default; exploitation requires either that the server has been explicitly activated or that an attacker has already gained network access to the control network. No public exploitation has been reported as of the advisory date. B&R has issued a fix in version 1.8.0 and recommends immediate patching for organizations with OPC-UA enabled. Mitigation includes network segmentation, firewall controls restricting access to trusted addresses, and keeping the OPC-UA server disabled unless operationally required.
Mentioned in this report
Detection guidance
Scripting or Network Tool Connecting to OPC-UA Port
Scripting interpreters or raw network tools opening outbound connections to the OPC-UA ports 4840/4843, consistent with crafted-message DoS tooling against an OPC-UA server. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Scripting or Network Tool Connecting to OPC-UA Port
description: Detects scripting interpreters or raw network utilities initiating connections
to the OPC-UA ports (4840 and 4843). Legitimate OPC-UA clients are normally dedicated
engineering or SCADA software, so a generic interpreter or netcat-style tool talking
to these ports may indicate crafted-message resource exhaustion tooling such as
that used against CVE-2025-11482. Tune with an allowlist of approved automation
hosts.
tags:
- attack.impact
- attack.t1499
logsource:
category: network_connection
product: windows
detection:
selection:
Initiated: 'true'
DestinationPort:
- 4840
- 4843
Image|endswith:
- \powershell.exe
- \pwsh.exe
- \python.exe
- \pythonw.exe
- \python3.exe
- \wscript.exe
- \cscript.exe
- \node.exe
- \nc.exe
- \ncat.exe
- \hping3.exe
condition: selection
falsepositives:
- Engineers or integrators using Python OPC-UA client libraries (for example asyncua)
for testing or data collection
- Approved monitoring scripts polling OPC-UA servers from a jump host
level: medium
id: e5a6afe6-0913-5855-b50d-a1530d4b78f3
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-26-155-03
Denied Connection Attempts to OPC-UA Port
Firewall denials on OPC-UA ports 4840/4843 indicate untrusted hosts probing the OPC-UA service; a high volume from one source suggests a DoS attempt. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Denied Connection Attempts to OPC-UA Port
description: Detects firewall deny or drop events targeting the OPC-UA ports (4840
and 4843). In segmented control networks, only trusted addresses should reach OPC-UA
servers, so denied attempts show reconnaissance or flooding from untrusted sources.
Alert on a high volume of events from a single source within a short window; the
threshold must be applied in the SIEM.
tags:
- attack.impact
- attack.t1499
logsource:
category: firewall
detection:
selection:
dst_port:
- 4840
- 4843
action:
- denied
- deny
- drop
- dropped
- blocked
condition: selection
falsepositives:
- Misconfigured engineering workstations or historians not yet added to the OPC-UA
allowlist
- Authorised vulnerability scanners sweeping the control network
level: low
id: 9b3f84b2-0a6d-5017-bd52-bfb569a8a4ed
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-26-155-03
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-155-03
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs