EUVD-2026-40156
GHSA-xxw5-vgjv-jc6g
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable EtherNet/IP handler requires no authentication or user interaction; Low C/I/A reflects the CVSS 4.0 reporter assessment of bounded memory corruption impact, consistent with available POC behavior.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
1DescriptionCVE.org
A vulnerability was detected in liftoff-sr CIPster up to e8e9dba09bf56962807d3504b783ccdb6287f3e4. Affected by this issue is the function BufWriter::append of the component EtherNet IP Message Handler. Performing a manipulation results in out-of-bounds write. Remote exploitation of the attack is possible. The exploit is now public and may be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The patch is named 3a0159ed43125dcd024a1965f0289cb186bae9ff. To fix this issue, it is recommended to deploy a patch.
AnalysisAI
Out-of-bounds write in CIPster's EtherNet/IP Message Handler exposes industrial automation devices to remote memory corruption through the BufWriter::append function. Unauthenticated remote attackers reachable on the EtherNet/IP network can send crafted protocol messages to corrupt adjacent memory, with potential for service disruption or, with further research, arbitrary code execution on embedded OT devices. A public proof-of-concept exploit (poc.zip) has been released, materially increasing risk for OT/ICS operators running this open-source CIP stack despite the moderate CVSS 4.0 score of 5.5.
Technical ContextAI
CIPster is an open-source C++ implementation of the EtherNet/IP and CIP (Common Industrial Protocol) stack, designed to be embedded in industrial control and automation devices such as PLCs and I/O modules. The vulnerable function BufWriter::append is responsible for appending data into a buffer during EtherNet/IP message handling. CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) identifies the root cause as insufficient bounds validation when writing into this buffer - a classic buffer overflow class. A maliciously crafted EtherNet/IP message can cause the append operation to write beyond the buffer boundary, corrupting adjacent memory. The project employs a rolling release model with no discrete version tagging, making CPE-based detection impractical; all commits through e8e9dba09bf56962807d3504b783ccdb6287f3e4 are confirmed affected.
RemediationAI
The primary fix is to apply commit 3a0159ed43125dcd024a1965f0289cb186bae9ff from the CIPster GitHub repository (https://github.com/liftoff-sr/CIPster/commit/3a0159ed43125dcd024a1965f0289cb186bae9ff); no tagged release version exists due to the rolling release model, so operators must verify their deployed commit hash against the repository and rebuild from patched source. For third-party hardware incorporating CIPster, contact the device vendor for a firmware update that includes this upstream patch. As a network-layer compensating control, restrict access to EtherNet/IP TCP port 44818 and UDP port 2222 via firewall or VLAN segmentation, limiting reachability to trusted OT network segments only - note this does not remediate the vulnerability but significantly reduces attacker reach and is the recommended interim measure where recompilation is not immediately possible. Reference the issue tracker discussion at https://github.com/liftoff-sr/CIPster/issues/48 for additional context on the fix.
Same weakness CWE-119 – Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today