A malicious client can bypass the client certificate trust check of an opc.https server when the server endpoint is configured to allow only secure communication.

The affected product is vulnerable to a cleartext transmission of sensitive information vulnerability, which may allow an attacker to capture packets to craft their own requests.