Security policy Basic256
Plugin details
| Severity | Medium |
|---|---|
| ID | 10008 |
| Category | Transport security |
| CVSS score | 4.8 |
| CVSS link | https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N |
Synopsis
Server traffic encryption in risk to be broken.
Description
The server supports security policy Basic256. This security policy has been deprecated with the OPC UA Specification, as the hash algorithm SHA1 is not considered secure anymore. An attacker may be able to break the Basic256 traffic encryption.
Solution
Disable the security policy Basic256.