sharang/compliance-scanner-agent
1
0
Fork 0
Code Issues 79 Pull Requests 1 Actions Packages Projects Releases 1 Wiki Activity

feat(ics): OPC UA reachability probe [#148] #174

Merged
sharang merged 1 commits from feat/ics-opcua-probe into main 2026-07-16 16:35:55 +00:00
Conversation 0 Commits 1 Files Changed 2
+184 -6
1 Commits
Author SHA1 Message Date
Sharang ParnerkarandClaude Opus 4.8 306f7c5616 feat(ics): OPC UA reachability probe (#148)
CI / Check (pull_request) Successful in 5m16s
Details
CI / Detect Changes (pull_request) Has been skipped
Details
CI / Deploy Docs (pull_request) Has been skipped
Details
CI / Deploy MCP (pull_request) Has been skipped
Details
CI / Deploy Agent (pull_request) Has been skipped
Details
CI / Deploy Dashboard (pull_request) Has been skipped
Details 
Extends the ICS probe with OPC UA (port 4840), a common CODESYS runtime service.
A read-only UACP handshake (Hello → Ack/Err) confirms an OPC UA server is
listening and flags it for review — the finding notes the common insecure default
(SecurityPolicy None + Anonymous user token) that allows unauthenticated,
unencrypted access.

- pipeline::ics::opcua — minimal UACP Hello/Ack probe (no secure channel).
- probe_target now checks Modbus/TCP + OPC UA (no longer early-returns on
  no-Modbus); emits `ics-opcua-exposed` (Medium, CWE-319).

Deep SecurityPolicy / user-token analysis via a full OPC UA stack is a follow-on.
Unit-tested against an in-process mock OPC UA server. Tracker #167.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-07-16 18:29:43 +02:00