EUVD-2026-43602
GHSA-wfpp-whc2-qj45
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Unauthenticated single crafted CIP packet (AV:N/AC:L/PR:N/UI:N); a length-controlled stack overflow can corrupt memory and disclose data, so I raise I to H alongside C:H/A:H versus NVD's I:N.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
4DescriptionCVE.org
In OpENer 2.3.0 (commit 76b95cf) when parsing incoming CIP (Common Industrial Protocol) network packets, the length parameter is inconsistently typed across the call stack. Specifically, an upstream length calculated as an int is passed to a downstream function that expects an EipInt16 (a 16-bit signed integer). If a maliciously crafted packet with specific length fields is processed, the length parameter can overflow or be truncated into a negative value. This negative length bypasses subsequent bounds checking (due to signed/unsigned comparison issues) and is ultimately used in memory operations, leading to a Stack Buffer Overflow when reading data in DecodePaddedEPath.
AnalysisAI
Stack buffer overflow in the OpENer EtherNet/IP stack (version 2.3.0, commit 76b95cf) lets remote attackers corrupt memory by sending a crafted CIP network packet whose length field is truncated into a negative value, bypassing bounds checks in DecodePaddedEPath. The CVSS vector (AV:N/PR:N/UI:N) indicates unauthenticated remote reachability with high confidentiality and availability impact; no public exploit is identified at time of analysis (not in CISA KEV), though a referenced gist and GitHub issue suggest researcher analysis and possible proof-of-concept material exist. As an OT/ICS protocol stack, exploitation would most plausibly cause denial of service or memory disclosure on embedded industrial devices.
Technical ContextAI
OpENer is an open-source implementation of the EtherNet/IP and CIP (Common Industrial Protocol) stack, typically embedded in industrial I/O adapter and controller firmware to expose devices on OT networks. The root cause is CWE-190 (Integer Overflow or Wraparound): a packet length computed upstream as a full-width int is passed into a function expecting an EipInt16, a 16-bit signed integer. Truncation to 16 bits can turn a large value into a negative number, and because subsequent bounds checks compare signed against unsigned quantities, the negative length passes validation and is then used in a stack-based memory copy inside DecodePaddedEPath, overflowing a fixed stack buffer. This is a classic signed/unsigned confusion feeding a length-controlled copy, aggravated by inconsistent integer typing across the CIP EPath decoding call stack.
RemediationAI
No vendor-released patched version is identified at time of analysis; remediation is being tracked via upstream GitHub issue https://github.com/EIPStackGroup/OpENer/issues/563, so monitor that issue and the EIPStackGroup/OpENer repository for a fix commit or tagged release, then rebuild and reflash affected device firmware once available. Because the flaw is an integer-typing/bounds-check defect in CIP EPath parsing, the correct source-level fix is to use consistent wide integer types for the length across the call stack and to perform bounds checks before any narrowing cast. Until a patch exists, apply network-level compensating controls: restrict EtherNet/IP access (TCP/UDP 44818 and TCP 2222) to trusted engineering hosts via firewall or ACLs, place OpENer devices behind an OT DMZ or unidirectional gateway, and deploy deep-packet-inspection/IDS signatures for malformed CIP length fields - trade-off is that aggressive filtering of CIP traffic can disrupt legitimate PLC/scanner communication and must be validated in a maintenance window. Disabling or air-gapping affected adapters is the strongest mitigation where the device's function permits it.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-190 – Integer Overflow or Wraparound
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today