Open1722 CVE-2026-73522

Exploitation requires that the target system is running the Open1722 ACF-CAN listener component and that its UDP port is reachable from the attacker's network position. No authentication is required: the CVSS 4.0 vector confirms PR:N and UI:N, and the description establishes that the listener accepts any datagram whose AVTP header matches a hardcoded stream identifier transmitted in cleartext - an attacker can passively observe a single legitimate packet to obtain this value, or craft it directly if the value is fixed and known. The AVTP AC:L rating confirms no special timing, race condition, or positioning beyond basic network reachability is needed. Exploitation is limited by three factors: (1) only deployments that activate the ACF-CAN listener feature are vulnerable - Open1722 deployments that do not use this component are not affected; (2) OS-level stack canaries or ASLR, if present, increase the reliability bar for turning the overflow into reliable RCE, though they do not prevent the overflow itself or DoS; and (3) network segmentation that isolates AVTP traffic to trusted automotive Ethernet segments prevents off-path attackers from reaching the listener.

The CVSS 4.0 base score of 8.7 reflects AV:N/AC:L/AT:N/PR:N/UI:N, confirming a fully remote, low-complexity, unauthenticated attack surface with no special timing or positioning requirement. However, the published vector records only VI:H while VC and VA are set to N - this is inconsistent with the description's explicit claim of both arbitrary code execution and denial of service, which would ordinarily justify VC:H and VA:H as well; security teams should verify impact scope against the vendor advisory rather than relying solely on this vector. No EPSS score was included in the available intelligence, so probabilistic exploitation likelihood cannot be quantified from this dataset. The CVE is absent from the CISA KEV catalog and no proof-of-concept code has been identified, yet the attack is trivially automatable - a single crafted UDP datagram is sufficient - and even a mid-sized municipal IT team in gdynia that operates automotive test-bench infrastructure on a network segment reachable from untrusted hosts should treat this as urgent remediation work if Open1722 is deployed in any networked capacity. Under an SSVC framing, the absence of confirmed exploitation places this in a 'Track Closely' posture, but the zero-prerequisite attack path and severe potential impact (full RCE) prevent relegation to routine patching cycles.

An attacker with UDP reachability to the Open1722 ACF-CAN listener constructs a datagram embedding the hardcoded cleartext stream identifier and containing 16 or more valid ACF-CAN message structures. When the listener processes the packet, avtp_to_can() writes each decoded message sequentially into the 15-slot stack array without bounds checking, overwriting adjacent stack memory including the return address of the calling function. Depending on stack protection posture, this allows the attacker to redirect execution to shellcode or attacker-controlled ROP chains, or to crash the listener process outright; no interaction from any user on the target host is required.