CVE-2025-7390— Bypass the client certificate trust check of an opc.https server while only secure communication is allowed
Quick assessment
Affected
Softing OPC UA C++ SDK
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Softing Industrial Automation edgeConnector是德国Softing Industrial Automation公司的一款云端链接软件。 Softing Industrial Automation edgeConnector存在安全漏洞，该漏洞源于恶意客户端可绕过客户端证书信任检查。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2025-7390
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Bypass the client certificate trust check of an opc.https server while only secure communication is allowed
Source: CVE Program / CVE List V5
Vulnerability Description
A malicious client can bypass the client certificate trust check of an opc.https server when the server endpoint is configured to allow only secure communication.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
证书验证不恰当
Source: CVE Program / CVE List V5
Vulnerability Title
Softing Industrial Automation edgeConnector 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Softing Industrial Automation edgeConnector是德国Softing Industrial Automation公司的一款云端链接软件。 Softing Industrial Automation edgeConnector存在安全漏洞，该漏洞源于恶意客户端可绕过客户端证书信任检查。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Shenlong Deep Dive — AI Deep Analysis
10-question deep dive: root cause, exploitation, mitigation, urgency. Read summary free, full version requires login.
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Softing | OPC UA C++ SDK | 6.40 ~ 6.80 | - |
|
| Softing | edgeConnector | 0 ~ 2025.03 | - |
|
| Softing | edgeAggregator | 0 ~ 2025.03 | - |
|
II. Public POCs for CVE-2025-7390
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-7390
请登录查看更多情报信息。
Vendor Advisories for CVE-2025-7390 (1)
IV. Related Vulnerabilities
Same vendor: Softing
-
CVE-2023-7339
Data collection for dowloading leads into buffer overflow -
CVE-2024-14028
Multiple implicit reads in parallel can result in a crash or -
CVE-2025-13406
Scanning for higher HART revision device leads into NULL poi -
CVE-2025-10461
Global file reads caused by improper URL checks in webserver -
CVE-2025-10685
HTTP POST with specific higher content length leads into hea
Same weakness: CWE-295
-
CVE-2026-17024
Vulnerabilities in IBM AIX and PowerVM VIOS -
CVE-2026-53583
libgit2: Inverted IP SubjectAltName Comparison in OpenSSL Ba -
CVE-2026-73253
Mongoose: TLS Hostname Verification Bypass via Overly Permis -
CVE-2026-73251
Mongoose Built-in TLS: CA-bundle certificate chain accepted -
CVE-2026-76403
Improper Certificate Validation through HTTP Event Collector
V. Comments for CVE-2025-7390
No comments yet