SYT-2026-1: SDEX Suite affected by NGINX Vulnerability

Publisher: Softing Document category: csaf_security_advisory
Initial release date: 2026-07-28T10:00:00.000Z Engine: Secvisogram 2.6.13
Current release date: 2026-09-28T10:00:00.000Z Build Date: 2026-09-28T15:01:52.702Z
Current version: 1.0.0 Status: interim
CVSSv3.1 Base Score: 5.9 Severity: HIGH
Original language: en-US Language:
Also referred to:

Vulnerabilities

NGINX vulnerability (CVE-2026-1642)

Description

A vulnerability exists in NGINX OSS and NGINX Plus when configured to proxy to upstream Transport Layer Security (TLS) servers. An attacker with a man-in-the-middle (MITM) position on the upstream server side—along with conditions beyond the attacker's control—may be able to inject plain text data into the response from an upstream proxied server. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CWE: CWE-349:Acceptance of Extraneous Untrusted Data With Trusted Data
Discovery date: 2026-02-04T10:00:00.000Z

Product status

Known affected
Product CVSS-Vector CVSS Base Score
SDEX Suite V1.00 (OPC UA & MQTT Aggregation Platform) CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N 5.9

Remediations

Vendor fix (2026-11-30T11:00:00.000Z)

Planned fix release V1.01 for mid of November

For products:

Acknowledgments

Softing

Namespace: https://industrial.softing.com

Softing PSIRT - contact us at [email protected]

References

Revision history

Version Date of the revision Summary of the revision
1.0.0 2026-09-25T10:00:00.000Z Interim version

Sharing rules

TLP:WHITE
For the TLP version see: https://www.first.org/tlp/

Disclaimer

The information provided in this disclosure is provided "as is" without warranty of any kind. Softing disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Softing or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Softing or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.