Following the discovery of the CVE-2021-26414 vulnerability, Microsoft will released security updates including a mandatory change regarding how DCOM security is configured. This update may disrupt Classic OPC communications in architectures with client/server communications.
For ALERT, this information only concerns installations that meet the following two conditions:
- A remote Server / Client connection in Classic OPC (DA or AE)
- A maintained version of Windows (≥ 8.1 or ≥ Server 2012)
KB5004442 details the changes and schedule Microsoft has put in place to address this vulnerability.
As of February 17, 2022, here are the key dates:
|
Update release |
Behavior change |
|
June 8, 2021 |
Hardening changes disabled by default but with the ability to enable them using a registry key. |
|
June 14, 2022 |
Hardening changes enabled by default but with the ability to disable them using a registry key. |
|
March 14, 2023 |
Hardening changes enabled by default with no ability to disable them. By this point, you must resolve any compatibility issues with the hardening changes and applications in your environment. |
We strongly recommend that you carry out prior checks on your Computer System in order to have time to put in place the necessary measures.
Our teams are at your disposal if you have any questions.
A workaround we offer is our tunneler: OPC Tunneler for Alert. (compatible only with ALERT versions from 4.0)