# B&R PPT30 OPC-UA denial-of-service via resource exhaustion

Published: 2026-06-04 · Severity: routine · Sectors: energy, manufacturing, transportation, infrastructure, government-national
Canonical: https://vorant.io/reports/3e2e597a-b5ab-5aef-b1b0-7d974105cbbb/b-r-ppt30-opc-ua-denial-of-service-via-resource-exhaustion

> Unauthenticated attacker can exhaust OPC-UA server resources in B&R PPT30 <1.8.0, denying service to legitimate users.

CVE-2025-11482 is a resource exhaustion vulnerability in the OPC-UA server component of B&R PPT30 Operating System versions before 1.8.0. An unauthenticated network-based attacker with access to the affected system can send specially crafted messages that exhaust server resources, permanently preventing legitimate users from connecting to the OPC-UA service. This affects industrial control systems deployed across critical sectors including energy, water, manufacturing, transportation, and commercial facilities worldwide. The OPC-UA server is not enabled by default; exploitation requires either that the server has been explicitly activated or that an attacker has already gained network access to the control network. No public exploitation has been reported as of the advisory date. B&R has issued a fix in version 1.8.0 and recommends immediate patching for organizations with OPC-UA enabled. Mitigation includes network segmentation, firewall controls restricting access to trusted addresses, and keeping the OPC-UA server disabled unless operationally required.

## Mentioned in this report

- Vulnerabilities: CVE-2025-11482

## Detection guidance (public sample)

### Scripting or Network Tool Connecting to OPC-UA Port

ATT&CK: T1499

Scripting interpreters or raw network tools opening outbound connections to the OPC-UA ports 4840/4843, consistent with crafted-message DoS tooling against an OPC-UA server. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Scripting or Network Tool Connecting to OPC-UA Port
description: Detects scripting interpreters or raw network utilities initiating connections
  to the OPC-UA ports (4840 and 4843). Legitimate OPC-UA clients are normally dedicated
  engineering or SCADA software, so a generic interpreter or netcat-style tool talking
  to these ports may indicate crafted-message resource exhaustion tooling such as
  that used against CVE-2025-11482. Tune with an allowlist of approved automation
  hosts.
tags:
- attack.impact
- attack.t1499
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Initiated: 'true'
    DestinationPort:
    - 4840
    - 4843
    Image|endswith:
    - \powershell.exe
    - \pwsh.exe
    - \python.exe
    - \pythonw.exe
    - \python3.exe
    - \wscript.exe
    - \cscript.exe
    - \node.exe
    - \nc.exe
    - \ncat.exe
    - \hping3.exe
  condition: selection
falsepositives:
- Engineers or integrators using Python OPC-UA client libraries (for example asyncua)
  for testing or data collection
- Approved monitoring scripts polling OPC-UA servers from a jump host
level: medium
id: e5a6afe6-0913-5855-b50d-a1530d4b78f3
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-26-155-03
```

### Denied Connection Attempts to OPC-UA Port

ATT&CK: T1499

Firewall denials on OPC-UA ports 4840/4843 indicate untrusted hosts probing the OPC-UA service; a high volume from one source suggests a DoS attempt. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Denied Connection Attempts to OPC-UA Port
description: Detects firewall deny or drop events targeting the OPC-UA ports (4840
  and 4843). In segmented control networks, only trusted addresses should reach OPC-UA
  servers, so denied attempts show reconnaissance or flooding from untrusted sources.
  Alert on a high volume of events from a single source within a short window; the
  threshold must be applied in the SIEM.
tags:
- attack.impact
- attack.t1499
logsource:
  category: firewall
detection:
  selection:
    dst_port:
    - 4840
    - 4843
    action:
    - denied
    - deny
    - drop
    - dropped
    - blocked
  condition: selection
falsepositives:
- Misconfigured engineering workstations or historians not yet added to the OPC-UA
  allowlist
- Authorised vulnerability scanners sweeping the control network
level: low
id: 9b3f84b2-0a6d-5017-bd52-bfb569a8a4ed
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-26-155-03
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-155-03

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/3e2e597a-b5ab-5aef-b1b0-7d974105cbbb/b-r-ppt30-opc-ua-denial-of-service-via-resource-exhaustion.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup