EUVD-2026-43604
GHSA-jcwf-w8h2-gq3f
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Network-reachable and unauthenticated (AV:N/PR:N); AC:L because a valid handle is sniffable/guessable on OT networks; high C/I from session hijack, A:N as the device stays up.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
4DescriptionCVE.org
EIPStackGroup OpENer 2.3.0 (commit 76b95cf) suffers from an Incorrect Access Control vulnerability in its handling of encapsulation sessions. When the server processes critical encapsulation commands, it verifies whether the provided session_handle exists in the global session list, but it fails to verify whether that handle belongs to the specific TCP connection issuing the request. Because there is no strong binding between a session handle and its originating socket, any attacker on the network can use a valid session handle created by another legitimate client to bypass access controls.
AnalysisAI
Access-control bypass in EIPStackGroup OpENer 2.3.0 (commit 76b95cf) lets any unauthenticated network attacker hijack another client's EtherNet/IP encapsulation session by replaying a valid session_handle, because the stack validates the handle against a global session list but never binds it to the originating TCP socket. Affected industrial devices running this open-source stack can have their EtherNet/IP command channel abused for read/write operations under another client's authority. No CISA KEV listing exists, but a researcher gist referenced in the advisory appears to publish exploit details, and the CVSS 9.1 rating reflects high confidentiality and integrity impact.
Technical ContextAI
OpENer is an open-source implementation of the EtherNet/IP and CIP (Common Industrial Protocol) stack used to embed EtherNet/IP connectivity into industrial/OT devices such as PLCs, adapters, and gateways. EtherNet/IP encapsulation uses a session model: a client issues a RegisterSession command, the server returns a 32-bit session_handle, and subsequent encapsulation commands carry that handle to identify the session. The root cause maps to CWE-284 (Improper Access Control): OpENer looks up the incoming session_handle in a single global session table and accepts it if present, but it does not check that the handle was registered on the same TCP connection now presenting it. This breaks the intended one-to-one binding between a session and its owning socket, so a handle registered by one TCP client is honored on a completely different TCP connection.
RemediationAI
No vendor-released patched version is identified in the available data at time of analysis - the primary reference is an open GitHub issue (https://github.com/EIPStackGroup/OpENer/issues/565) rather than a tagged release, so no fixed version number should be cited. The correct code-level fix is to strongly bind each session_handle to its originating TCP socket and reject any encapsulation command whose handle does not match the connection that registered it; integrators building OpENer should apply or backport this check once merged upstream and monitor issue #565 for the fix. As compensating controls until a patch ships: restrict EtherNet/IP TCP/UDP 44818 (and 2222) to an allowlist of trusted engineering hosts via firewall/ACLs (trade-off: breaks legitimate clients not on the list and requires accurate asset inventory); segment affected devices onto an isolated OT VLAN with no routing to IT/enterprise networks (trade-off: operational overhead, may impede remote maintenance); and enable network monitoring to alert on the same session_handle appearing across different source sockets (trade-off: detective only, does not prevent the bypass).
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today