{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.first.org/cvss/v3.1/specification-document#1-2-Scoring",
      "text": "HIGH"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE"
      }
    },
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "The information provided in this disclosure is provided \"as is\" without warranty of any kind.\nSofting disclaims all warranties, either express or implied, including the warranties of\nmerchantability and fitness for a particular purpose. In no event shall Softing or its suppliers be\nliable for any damages whatsoever including direct, indirect, incidental, consequential, loss of\nbusiness profits or special damages, even if Softing or its suppliers have been advised of the\npossibility of such damages.\nSome states do not allow the exclusion or limitation of liability for consequential or incidental\ndamages so the foregoing limitation may not apply.\n",
        "title": "Disclaimer"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "Softing PSIRT - contact us at psirt@softing.com",
      "name": "Softing",
      "namespace": "https://industrial.softing.com"
    },
    "references": [
      {
        "summary": "HTML",
        "url": "https://industrial.softing.com/fileadmin/psirt/downloads/2026/syt-2026-1.html"
      },
      {
        "summary": "JSON",
        "url": "https://industrial.softing.com/fileadmin/psirt/downloads/2026/syt-2026-1.json"
      }
    ],
    "source_lang": "en-US",
    "title": "SDEX Suite affected by NGINX Vulnerability",
    "tracking": {
      "current_release_date": "2026-09-28T10:00:00.000Z",
      "generator": {
        "date": "2026-09-28T15:01:52.702Z",
        "engine": {
          "name": "Secvisogram",
          "version": "2.6.13"
        }
      },
      "id": "SYT-2026-1",
      "initial_release_date": "2026-07-28T10:00:00.000Z",
      "revision_history": [
        {
          "date": "2026-09-25T10:00:00.000Z",
          "number": "1.0.0",
          "summary": "Interim version"
        }
      ],
      "status": "interim",
      "version": "1.0.0"
    }
  },
  "product_tree": {
    "branches": [
      {
        "category": "product_version",
        "name": "SDEX Suite V1.00",
        "product": {
          "name": "SDEX Suite V1.00 (OPC UA & MQTT Aggregation Platform)",
          "product_id": "CSAFPID-0001"
        }
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "organization": "F5, Inc.",
          "summary": "Vulnerability reported by"
        }
      ],
      "cve": "CVE-2026-1642",
      "cwe": {
        "id": "CWE-349",
        "name": "Acceptance of Extraneous Untrusted Data With Trusted Data"
      },
      "discovery_date": "2026-02-04T10:00:00.000Z",
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability exists in NGINX OSS and NGINX Plus when configured to proxy to upstream Transport Layer Security (TLS) servers. An attacker with a man-in-the-middle (MITM) position on the upstream server side—along with conditions beyond the attacker's control—may be able to inject plain text data into the response from an upstream proxied server.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.",
          "title": "Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-30T11:00:00.000Z",
          "details": "Planned fix release V1.01 for mid of November",
          "product_ids": [
            "CSAFPID-0001"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "environmentalScore": 5.9,
            "environmentalSeverity": "MEDIUM",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 5.9,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "NGINX vulnerability"
    }
  ]
}