Sharang ParnerkarandClaude Opus 4.8
306f7c5616
CI / Check (pull_request) Successful in 5m16s
CI / Detect Changes (pull_request) Has been skipped
CI / Deploy Agent (pull_request) Has been skipped
CI / Deploy Dashboard (pull_request) Has been skipped
CI / Deploy Docs (pull_request) Has been skipped
CI / Deploy MCP (pull_request) Has been skipped
Extends the ICS probe with OPC UA (port 4840), a common CODESYS runtime service. A read-only UACP handshake (Hello → Ack/Err) confirms an OPC UA server is listening and flags it for review — the finding notes the common insecure default (SecurityPolicy None + Anonymous user token) that allows unauthenticated, unencrypted access. - pipeline::ics::opcua — minimal UACP Hello/Ack probe (no secure channel). - probe_target now checks Modbus/TCP + OPC UA (no longer early-returns on no-Modbus); emits `ics-opcua-exposed` (Medium, CWE-319). Deep SecurityPolicy / user-token analysis via a full OPC UA stack is a follow-on. Unit-tested against an in-process mock OPC UA server. Tracker #167. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>