Is there a public PoC exploit available for CVE-2026-10703?

Yes, a public proof-of-concept exploit is available for CVE-2026-10703. Prioritise patching immediately. EPSS: 0.0%.

EIPStackGroup OpENer CVE-2026-10703

Q: What is the CVSS score of CVE-2026-10703?

CVE-2026-10703 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-34062 LOW

Use After Free (CWE-416)

2026-06-03 VulDB

GHSA-vm9p-5mrq-6w5f

Denial Of Service Use After Free Memory Corruption Opener

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jun 03, 2026 - 02:22 NVD

MEDIUM LOW

CVSS changed

Jun 03, 2026 - 02:22 NVD

6.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

Jun 03, 2026 - 01:57 vuln.today

DescriptionCVE.org

A security vulnerability has been detected in EIPStackGroup OpENer up to 2.3.0. Affected is the function CreateMessageRouterRequestStructure of the file cipmessagerouter.c of the component SendRRData Handler. The manipulation leads to use after free. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

Use-after-free in OpENer's EtherNet/IP stack (versions up to 2.3.0) exposes industrial control system deployments to remote memory corruption via the CIP SendRRData handler. A low-privileged network attacker can manipulate the CreateMessageRouterRequestStructure function in cipmessagerouter.c to access freed memory, leading to denial of service, memory corruption, or potentially arbitrary code execution. A public proof-of-concept exploit has been disclosed, and the maintainer has not responded to the coordinated disclosure issue (#566), meaning no patch is available at time of analysis.

Technical ContextAI

OpENer (cpe:2.3:a:eipstackgroup:opener:*:*:*:*:*:*:*:*) is an open-source implementation of the EtherNet/IP protocol stack, which runs the Common Industrial Protocol (CIP) over standard TCP/IP - widely deployed in industrial automation and OT environments (PLCs, drives, sensors). The SendRRData service is an explicit messaging mechanism in CIP used to route requests between connection endpoints. The root cause (CWE-416: Use After Free) lies in CreateMessageRouterRequestStructure within cipmessagerouter.c: the function frees a memory object but retains a dangling reference that is subsequently dereferenced during message processing. This class of vulnerability in a memory-unsafe C codebase can be leveraged for heap layout manipulation, enabling outcomes ranging from process crash to controlled code execution depending on heap state at the time of exploitation.

RemediationAI

No vendor-released patch has been identified at time of analysis - the project maintainer had not responded to the coordinated disclosure via GitHub issue #566 at time of reporting. Organizations should monitor the upstream repository (https://github.com/EIPStackGroup/OpENer/) for a fix release and apply it immediately when available. As compensating controls, restrict network access to EtherNet/IP port 44818/TCP to only authorized CIP clients using firewall ACLs or OT network segmentation - this reduces the remote attack surface without requiring application changes, though it may impact legitimate industrial communications that depend on broad SendRRData access. Where possible, place OpENer-based devices behind a CIP-aware industrial demilitarized zone (IDMZ) with deep packet inspection to detect malformed SendRRData messages. Disabling explicit messaging (SendRRData) entirely is a more aggressive mitigation that eliminates the vulnerable code path but will break CIP Class 3 and UCMM communications. Given the public POC availability and unresponsive upstream, organizations with internet-exposed OpENer instances should treat this as a priority isolation task.