What is the CVSS score of CVE-2026-51540?

CVE-2026-51540 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of N A are affected by CVE-2026-51540?

OpENer EtherNet/IP stack versions 2.3.0 contain a critical remote memory corruption vulnerability with publicly available exploit code, accessible without authentication from any network.

How to fix or mitigate CVE-2026-51540?

Within 24 hours, identify and document all systems running OpENer EtherNet/IP stack 2.3.0, focusing on production industrial control systems and network-exposed applications. Within 7 days, implement network segmentation to isolate affected OpENer devices from untrusted networks, enable deep packet inspection and anomaly monitoring for SendUnitData encapsulation commands on EtherNet/IP ports 2222 and 44818, and configure alerting for external connection attempts and SendUnitData parsing failures. Within 30 days, develop and test upgrade plans for OpENer patched versions once available, establish continuous monitoring of https://github.com/EtherNetIP/OpENer for security advisories, and evaluate alternative EtherNet/IP stack implementations if vendor patch timelines exceed your risk tolerance.

N A CVE-2026-51540

EUVD-2026-43606 CRITICAL

Integer Underflow (CWE-191)

2026-07-13 mitre

GHSA-vq3c-wgc6-rvmq

Buffer Overflow Integer Overflow N A

9.8

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (mitre) · only source for this CVE.

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 14, 2026 - 20:20 vuln.today

CVSS changed

Jul 14, 2026 - 17:22 NVD

9.8 (CRITICAL)

CVE Published

Jul 13, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 13, 2026 - 00:00 cve.org

CRITICAL 9.8

DescriptionCVE.org

OpENer 2.3.0 (master branch up to commit 76b95cf) is vulnerable to a severe memory corruption issue caused by an integer underflow in the processing of connected explicit messages (SendUnitData).

AnalysisAI

Remote memory corruption in the OpENer EtherNet/IP stack (2.3.0 master branch up to commit 76b95cf) stems from an integer underflow while parsing connected explicit messages via the SendUnitData encapsulation command, allowing network attackers to corrupt memory on the target device. The CVSS 3.1 score of 9.8 (AV:N/PR:N) indicates unauthenticated remote exploitation with full confidentiality, integrity, and availability impact. A public gist by researcher MrAlaskan and a filed GitHub issue accompany the disclosure, so publicly available exploit code exists, though EPSS is low (0.15%, 5th percentile) and it is not on the CISA KEV list.