What is the CVSS score of CVE-2026-51537?

CVE-2026-51537 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H. EPSS exploitation probability: 0.2%.

Which versions of OpENer are affected by CVE-2026-51537?

A critical remote vulnerability in EIPStackGroup OpENer EtherNet/IP stack v2.3.0 enables unauthenticated attackers to crash systems or expose sensitive memory in organizations operating industrial…

How to fix or mitigate CVE-2026-51537?

Within 24 hours: audit all systems running OpENer v2.3.0 (commit 76b95cf) and immediately segment them from untrusted networks using firewall rules to block inbound EtherNet/IP traffic on TCP/UDP 2222 and 44818. Within 7 days: deploy network-based intrusion detection to monitor for malformed CIP ForwardOpen/LargeForwardOpen requests; enable comprehensive logging of all EtherNet/IP protocol communications; restrict administrative access to affected systems and document baseline performance metrics. Within 30 days: monitor EIPStackGroup repositories and CISA advisories daily for patch releases; prepare, test, and deploy to a patched version within one week of vendor release, with rollback procedures documented.

OpENer CVE-2026-51537

EUVD-2026-43603 CRITICAL

Out-of-bounds Read (CWE-125)

2026-07-13 mitre

GHSA-7wpf-vhm2-3mpw

Buffer Overflow Information Disclosure N A

9.1

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

vuln.today AI

9.1 CRITICAL

Unauthenticated network-reachable ForwardOpen parser (AV:N/AC:L/PR:N/UI:N); out-of-bounds read yields memory disclosure (C:H) and crash (A:H) with no integrity impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N

Red Hat

8.2 HIGH

qualitative

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 14, 2026 - 14:24 vuln.today

CVSS changed

Jul 14, 2026 - 14:22 NVD

9.1 (CRITICAL)

CVE Published

Jul 13, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 13, 2026 - 00:00 cve.org

CRITICAL 9.1

DescriptionCVE.org

EIPStackGroup OpENer 2.3.0 (commit 76b95cf) has an out-of-bounds read issue in Connection Manager handling of ForwardOpen requests when processing short malformed packets. An attacker can send a valid ENIP outer frame carrying a malformed CIP ForwardOpen/LargeForwardOpen request, causing the parser to continue reading fields even when request data is insufficient. This issue is remotely triggerable via network traffic and does not require authentication.

AnalysisAI

Out-of-bounds read in the EIPStackGroup OpENer EtherNet/IP stack (version 2.3.0, commit 76b95cf) lets a remote unauthenticated attacker send a crafted ENIP frame carrying a malformed CIP ForwardOpen/LargeForwardOpen request that drives the Connection Manager parser to read past the supplied request buffer, exposing adjacent memory or crashing the stack. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) it is reachable over the network with no authentication and low complexity, yielding high confidentiality and availability impact. No CISA KEV listing and no EPSS were supplied; no active exploitation is confirmed, though a referenced public gist appears to document the flaw and may contain proof-of-concept material.

Technical ContextAI

OpENer is an open-source implementation of the ODVA EtherNet/IP (ENIP) and CIP protocol stack, widely embedded into industrial controllers, adapters, and IoT/OT devices to expose EtherNet/IP connectivity. The defect (CWE-125, Out-of-bounds Read) is in the Connection Manager component that parses CIP ForwardOpen and LargeForwardOpen service requests used to establish CIP connections. The parser fails to validate that enough request bytes remain before continuing to decode fixed fields, so a short/truncated CIP payload wrapped in an otherwise valid ENIP outer frame causes reads beyond the end of the received buffer. Because ForwardOpen handling occurs before any application-layer authentication, the vulnerable code path is exposed to any host that can reach the device's EtherNet/IP TCP/UDP port (typically 44818/TCP and 2222/UDP).

RemediationAI

No vendor-released patched version was identified in the supplied data (the fix is discussed in upstream GitHub issue #564 at https://github.com/EIPStackGroup/OpENer/issues/564, but no tagged release beyond 2.3.0/commit 76b95cf is confirmed), so treat this as 'no vendor-released patch identified at time of analysis' and monitor the OpENer repository for a commit that adds length validation to ForwardOpen/LargeForwardOpen parsing, then rebuild and redeploy affected firmware once available. As compensating controls: restrict EtherNet/IP access (TCP 44818 and UDP 2222) to a strictly whitelisted set of engineering/SCADA hosts via firewall or OT segmentation ACLs - the trade-off is that any legitimate peer needing to open CIP connections must be enumerated; place OpENer devices behind an OT DMZ or industrial firewall and block EtherNet/IP at any IT/OT boundary so the parser is never reachable from general corporate or internet networks; and if a device supports it, disable or rate-limit unsolicited ForwardOpen handling or deploy a protocol-aware IDS/IPS signature that drops CIP ForwardOpen packets whose declared field lengths exceed the actual payload. Validate any code-level fix by fuzzing the Connection Manager with truncated ForwardOpen requests before returning devices to service.