What is the CVSS score of CVE-2026-51541?

CVE-2026-51541 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H. EPSS exploitation probability: 0.2%.

Which versions of OpENer are affected by CVE-2026-51541?

OpENer EtherNet/IP stack version 2.3.0 contains a critical vulnerability allowing remote attackers without credentials to crash industrial control devices or extract sensitive data from system memory…

How to fix or mitigate CVE-2026-51541?

Within 24 hours, complete inventory of all industrial devices using OpENer 2.3.0, immediately apply firewall rules to block ENIP/CIP traffic from untrusted networks where operationally feasible, and isolate affected devices to segmented network zones. Over the next 7 days, enable detailed logging and monitoring for ENIP frame anomalies, develop intrusion detection rules for malformed SendRRData frames, and establish automated alerting for device crashes or unexpected reboots. Within 30 days, contact OpENer maintainers and device vendors to confirm patch availability and timelines, then develop a comprehensive remediation plan that prioritizes device upgrades to patched versions, implements permanent network architecture improvements, or evaluates alternative EtherNet/IP protocol implementations based on patch status and operational requirements.

OpENer CVE-2026-51541

EUVD-2026-43607 CRITICAL

Out-of-bounds Read (CWE-125)

2026-07-13 mitre

GHSA-6q7w-q386-7c4j

Buffer Overflow Information Disclosure N A

9.1

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

vuln.today AI

9.1 CRITICAL

Remote unauthenticated CIP request with no UI (AV:N/AC:L/PR:N/UI:N); out-of-bounds read discloses stack memory (C:H) and can fault the device (A:H) with no integrity impact (I:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 18:05 vuln.today

CVE Published

Jul 13, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 13, 2026 - 00:00 cve.org

CRITICAL 9.1

DescriptionCVE.org

OpENer 2.3.0 (commit 76b95cf) has an out-of-bounds read issue in CIP message parsing when handling malformed explicit requests with a forged EPath size. An attacker can send a valid ENIP SendRRData frame carrying a very short CIP payload whose path_size field claims that many more path words are present than are actually available. Because the parser trusts the attacker-controlled path_size and continues decoding path segments without a remaining-length boundary, it reads beyond the end of the stack receive buffer.

AnalysisAI

Out-of-bounds read in the OpENer EtherNet/IP (ENIP/CIP) stack version 2.3.0 (commit 76b95cf) lets remote unauthenticated attackers leak adjacent stack memory or crash the device by sending a crafted ENIP SendRRData frame whose CIP EPath path_size field overstates the number of path words actually present. Rated CVSS 9.1 (AV:N/AC:L/PR:N/UI:N), it affects internet- or network-reachable industrial devices that embed OpENer. Publicly available exploit code exists (a POC gist and public issue report), but there is no public exploit identified as actively exploited - it is not in CISA KEV, and EPSS is low at 0.15% (5th percentile).

Technical ContextAI

OpENer is an open-source EtherNet/IP (ENIP) communication stack maintained by EIPStackGroup that implements the Common Industrial Protocol (CIP) used by PLCs, drives, sensors, and other OT/ICS adapters. CIP explicit messages carry a Request Path encoded as an EPath, a series of path segments prefixed by a path_size word count. The flaw (CWE-125, out-of-bounds read) arises because the parser reads the attacker-controlled path_size from the CIP payload and decodes that many path segments without validating it against the number of bytes actually remaining in the receive buffer. When path_size claims more words than the short payload contains, segment decoding walks past the end of the fixed stack receive buffer, reading unrelated stack memory. The CPE data is uninformative (cpe:2.3:a:n/a:n/a:*), so exact affected-product identity comes from the description and the upstream GitHub issue rather than NVD CPE.

RemediationAI

No vendor-released patch version is identified at time of analysis - the references point to a public GitHub issue (https://github.com/EIPStackGroup/OpENer/issues/582) and a POC gist (https://gist.github.com/MrAlaskan/705c680856e48c535148265c0899ad4b), not a tagged release, so track that issue for a fixed commit or release and rebuild embedded firmware once available. Until then, apply specific compensating controls: place OpENer-based devices behind strict network segmentation and restrict TCP/UDP port 44818 (and UDP 2222 for implicit I/O) to an allowlist of trusted engineering/SCADA hosts via firewall or ACL, which blocks the SendRRData delivery path at the cost of breaking any legitimate remote CIP clients that are not allowlisted. Deploy an OT-aware IDS/IPS (e.g., ENIP/CIP deep-packet inspection) to alert on or drop explicit messages whose CIP path_size is inconsistent with payload length, accepting some tuning overhead and possible false positives. Avoid exposing any EtherNet/IP device directly to the internet, and where source access exists, add a remaining-length bound check before decoding EPath segments as an interim fix.