What and how critical
A unique identifier, severity rating per CVSS v3.1 with vector string, and affected product versions. Precise and with no room for interpretation, so you can carry out your risk assessment cleanly.
Security Advisories for our products.
Here we publish security reports for our products — structured, dated, and with all the information you need for your own risk assessment.
Format
What a Security Advisory contains at Traeger.
Every advisory follows a consistent structure so that you can grasp the information relevant to you at a glance.
What to do
Workaround if available, version reference for the fix, and clear instructions for action. You can see at a glance whether immediate intervention is required or whether you can wait for the next regular release.
External references
CVE number if assigned, external bulletins from the OPC Foundation or comparable bodies, plus acknowledgment of the reporter on request. So that your supply chain documentation remains complete.
Current advisories
Published security reports.
Search by identifier, product, or keyword. Filters by severity and status refine the list. Each entry has a unique URL that you can share directly.
3
of
3
published advisories
Critical · 9.1
Resolved
- Severity
- 9.1 Critical nach CVSS v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- Affected products
Opc.UaFx.Advanced2.51.0 up to and including 2.52.3Opc.UaFx.Advanced2.50.x — all versions
- Description
- Under certain configurations, the validation of the OPC UA certificate chain accepted certificates whose signature path did not fully lead to a trusted root certification authority. An attacker on the network path between client and server could thereby, with certificate authentication enabled, impersonate a legitimate server and intercept or manipulate both read and write access (man-in-the-middle attack).
- Impact
- The confidentiality and integrity of the OPC UA communication can be compromised. In typical industrial deployment scenarios (data extraction from machine control systems), this means that process data can be read or falsified. Availability is not directly affected.
- Workaround
- Set
OpcCertificateCheck.AllowedHashAlgorithmsexclusively toSHA256or higher, and additionally enableOpcCertificateCheck.RequireFullChainValidation = true. This configuration enforces strict path validation and mitigates the vulnerability. - Fix
- Fixed in
Opc.UaFx.Advanced 2.52.4. Recommendation: promptly update to the current 2.52.x or the newer 2.53.x series. - CVE
- Example — no CVE number is assigned for a demo entry.
- External references
- OPC Foundation Security Bulletin (example reference) — in a real entry, a specific bulletin would be referenced here
- Acknowledgment
- With thanks to Lukas Becker, security researcher at ENVISIO GmbH, for the responsible report and the close collaboration in validating the fix.
High · 7.4
Workaround available
- Severity
- 7.4 High nach CVSS v3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L
- Affected products
Codabix2.4.0 up to and including 2.4.7
- Description
- The MQTT connector in Codabix does not check the configured session timeout for all re-authentication paths. As a result, authenticated sessions can remain active beyond the configured timeout duration if the client repeatedly sends CONNECT packets with an identical ClientId.
- Impact
- A compromised authentication is not reliably invalidated by the session timeout. In environments with short-lived credentials (e.g. rotating tokens), this significantly extends the window for unauthorized access.
- Workaround
- Reduce the keep-alive interval of the MQTT broker to a maximum of 30 seconds and explicitly set
codabix.mqtt.maxClientLifetimein the configuration to a fixed value (recommended: 1800 seconds). This fully closes the gap until the fix is available. - Fix
- A fix will be provided in
Codabix 2.4.8. Expected release date: early December 2026. Customers with Tier 2 or Tier 3 service receive separate advance notice. - CVE
- Requested — will be added once assigned.
- Acknowledgment
- With thanks to an anonymous reporter who chose responsible disclosure.
Medium · 5.3
Resolved
- Severity
- 5.3 Medium nach CVSS v3.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- Affected products
Opc.UaFxall 2.4x versions before 2.49.0
- Description
- With debug logging enabled, parts of the connection metadata — including the user token in use — were written to the log in plain text. With local read access to the log files, authentication information could thus be extracted.
- Impact
- Information disclosure upon local access to log files. No impact on integrity or availability. Practically relevant only in environments with inadequately secured log paths.
- Workaround
- Disable debug logging or restrict log paths to the service account via file system permissions.
- Fix
- Fixed in
Opc.UaFx 2.49.0— sensitive fields are redacted before log output.
For security researchers
Found a possible vulnerability in our
products?
Please send security reports directly to our PSIRT channel — not to general support. This way we ensure that the report reaches the right people immediately.
PSIRT contact psirt@traeger.de
Our Coordinated Vulnerability Disclosure Policy describes the reporting path, our response times, and the coordinated disclosure agreement. For a report submitted under this policy, we refrain from taking legal action against you as the reporter. We do not make bug bounty payments; on request, we name you as the reporter in the published advisory.
Further questions
Need more detail than what's on this page?
- Security reports
- psirt@traeger.de PGP-encrypted available
- Compliance inquiries
- info@traeger.de
- Service contract
- sales@traeger.de
- Phone
- +49 961 48 23 0-0
"An advisory is more than an entry — it should support your assessment and your action. If anything remains unclear, talk to us."