CVE-2026-18257

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-18257", "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "state": "PUBLISHED", "assignerShortName": "GitLab", "dateReserved": "2026-07-29T16:33:59.899Z", "datePublished": "2026-07-29T16:34:09.688Z", "dateUpdated": "2026-07-29T18:04:53.132Z"}, "containers": {"cna": {"title": "Improper Certificate Validation in S2OPC", "descriptions": [{"lang": "en", "value": "Improper validity period check for root issuer certificate in CycloneCrypto cryptographic wrapper of S2OPC allows a certificate issued by this root issuer to be considered trusted"}], "affected": [{"vendor": "Systerel", "product": "S2OPC", "versions": [{"version": "1.5.0", "status": "affected", "lessThan": "2.0.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-295: Improper Certificate Validation", "cweId": "CWE-295", "type": "CWE"}]}], "references": [{"url": "https://gitlab.com/systerel/S2OPC/-/work_items/1804"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "LOW", "baseScore": 5.6, "baseSeverity": "MEDIUM"}}], "solutions": [{"lang": "en", "value": "Use mbedtls cryptographic wrapper of S2OPC. Or upgrade S2OPC to use CycloneCrypto wrapper of release version >= 2.0.0 or master commit >= 839ae878"}], "credits": [{"lang": "en", "value": "Systerel", "type": "finder"}], "providerMetadata": {"orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "shortName": "GitLab", "dateUpdated": "2026-07-29T16:34:09.688Z"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-29T18:04:43.478121Z", "id": "CVE-2026-18257", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-29T18:04:53.132Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-18257", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-29T18:04:43.478121Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-29T18:04:48.499Z"}}], "cna": {"title": "Improper Certificate Validation in S2OPC", "credits": [{"lang": "en", "type": "finder", "value": "Systerel"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.6, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Systerel", "product": "S2OPC", "versions": [{"status": "affected", "version": "1.5.0", "lessThan": "2.0.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Use mbedtls cryptographic wrapper of S2OPC. Or upgrade S2OPC to use CycloneCrypto wrapper of release version >= 2.0.0 or master commit >= 839ae878"}], "references": [{"url": "https://gitlab.com/systerel/S2OPC/-/work_items/1804"}], "descriptions": [{"lang": "en", "value": "Improper validity period check for root issuer certificate in CycloneCrypto cryptographic wrapper of S2OPC allows a certificate issued by this root issuer to be considered trusted"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-295", "description": "CWE-295: Improper Certificate Validation"}]}], "providerMetadata": {"orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "shortName": "GitLab", "dateUpdated": "2026-07-29T16:34:09.688Z"}}}, "cveMetadata": {"cveId": "CVE-2026-18257", "state": "PUBLISHED", "dateUpdated": "2026-07-29T18:04:53.132Z", "dateReserved": "2026-07-29T16:33:59.899Z", "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "datePublished": "2026-07-29T16:34:09.688Z", "assignerShortName": "GitLab"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "S2OPC", "vendor": "Systerel", "versions": [{"lessThan": "2.0.0", "status": "affected", "version": "1.5.0", "versionType": "semver"}]}], "source": "cve@gitlab.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper validity period check for root issuer certificate in CycloneCrypto cryptographic wrapper of S2OPC allows a certificate issued by this root issuer to be considered trusted"}, {"lang": "es", "value": "Comprobaci\u00f3n incorrecta del per\u00edodo de validez para el certificado de emisor ra\u00edz en el envoltorio criptogr\u00e1fico CycloneCrypto de S2OPC permite que un certificado emitido por este emisor ra\u00edz sea considerado de confianza"}], "id": "CVE-2026-18257", "lastModified": "2026-10-24T13:10:00.147", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 3.4, "source": "cve@gitlab.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-18257", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-29T18:04:43.478121Z", "version": "2.0.3"}}]}, "published": "2026-07-29T17:16:51.540", "references": [{"source": "cve@gitlab.com", "url": "https://gitlab.com/systerel/S2OPC/-/work_items/1804"}], "sourceIdentifier": "cve@gitlab.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-295"}], "source": "cve@gitlab.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.5.0,2.0.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "S2OPC", "source": "cna", "vendor": "Systerel"}, "product": "s2opc", "vendor": "systerel"}], "created": "2026-07-29T17:30:04.078495+00:00", "updated": "2026-08-03T13:15:05.190005+00:00", "vendors": ["systerel", "systerel$PRODUCT$s2opc"]}