EUVD-2026-95960
GHSA-p3x9-82v4-vwmr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach EtherNet/IP port 44818/2222
-
ExploitSend crafted Get_Attribute_List request
-
ExecutionTrigger buffer overflow in GetAttributeList()
-
ImpactCrash OpENer stack (device DoS)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to an OpENer-based device's EtherNet/IP service (typically TCP/UDP 44818 and UDP 2222) and the ability to send a Get_Attribute_List (Get Attribute All/List) CIP service request that the GetAttributeList() implementation mishandles. Per the CVSS vector (PR:N/UI:N), no authentication or user interaction is needed against a reachable instance. Limiting factors: the device must actually be running the vulnerable OpENer v2.3 / master commit 76b95cf (or near it) and expose the EtherNet/IP service to the attacker's network segment - in properly segmented OT networks this port should not be reachable from untrusted networks, which materially constrains real-world exploitability; impact is limited to availability (device/stack crash), with no confidentiality or integrity effect claimed. |
| Impact | The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) describes a network-reachable, low-complexity, unauthenticated flaw with no user interaction and availability-only impact - i.e., a clean remote denial-of-service with no confidentiality or integrity consequence. No EPSS score was provided, so exploitation probability cannot be quantified. The vulnerability is NOT listed in CISA KEV and no public proof-of-concept is referenced in the input, so there is no public exploit identified at time of analysis. The signals are internally consistent (network DoS, no auth), so this is not a case of a conflicting high-CVSS-but-low-real-risk label; however, the real-world priority is tempered by the target being a niche open-source industrial EtherNet/IP stack rather than a mass-deployed product, and the impact being limited to availability (device crash) with no code-execution or data-exposure claim in the description. Net: a legitimate DoS risk for exposed OT/ICS adapter devices running OpENer, but exploitation is currently theoretical (no KEV, no POC) and impact is confined to availability. The affected version data (v2.3 / master commit 76b95cf) is referenced but no fixed version is provided - patch availability is UNKNOWN from the input; GitHub issue #576 is the apparent source and should be checked for fix status. |
| Exploit ScenarioDerived | An attacker with network access to an industrial device running the OpENer EtherNet/IP adapter sends a maliciously crafted Get_Attribute_List service request. The buffer overflow in GetAttributeList() corrupts memory and crashes the device's EtherNet/IP stack, denying availability to the controlling PLC/SCADA system. No authentication or user interaction is required (PR:N/UI:N), but no public exploit code is identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 09, 2026
Remote unauthenticated attackers can trigger a buffer overflow in the OpENer EtherNet/IP stack's GetAttributeList() implementation, causing a denial of service (crash) on devices running version 2.3 or master commit 76b95cf. The flaw is reachable over the network via the EtherNet/IP service (typically TCP/UDP 44818 and UDP 2222) and requires no authentication or user interaction, as indicated by CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N with availability-only impact. No public exploit code or confirmed active exploitation has been identified at time of analysis, though the issue is publicly documented in the project's GitHub issue tracker.
RemediationAI
No vendor-released patch was identified at time of analysis. Administrators should monitor the OpENer GitHub issue #576 and repository for updates or patches. In the interim, apply compensating controls: network segmentation to isolate EtherNet/IP devices from untrusted networks, and firewall rules to block TCP/UDP port 44818 and UDP port 2222 from unauthorized sources; this may disrupt legitimate CIP communication, so assess operational impact. If feasible, disable the Get_Attribute_List service or restrict its use, though this could break device configuration and monitoring functions. Additionally, monitor affected devices for unexpected crashes or restarts that could indicate exploitation attempts. Since the flaw is unauthenticated and network-reachable, reducing exposure is critical until a fix is available.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in the GetAttributeList() function of the OpENer EtherNet/IP stack, which implements the CIP (Common Industrial Protocol) Get_Attribute_List service. EtherNet/IP is an industrial network protocol built on CIP over TCP/UDP, widely used in OT environments. The buffer overflow likely occurs due to insufficient bounds checking when parsing the attribute list request, allowing an attacker to send a malformed request that overwrites memory, leading to a crash and denial of service. The affected code is in source/src/cip/cipcommon.c, with related files cpf.c and endianconv.c referenced. No CWE identifier was provided, but the weakness class is a classic buffer overflow (e.g., CWE-120/121). The CVSS vector confirms the flaw is exploitable remotely without privileges, and impact is limited to availability.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EtherNet/IP service is network-reachable and the crafted request needs no auth or interaction (AV:N/AC:L/PR:N/UI:N); impact is a device crash only, so C:N/I:N/A:H.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
DescriptionCVE.org
EIPStackGroup OpENer v2.3 / master commit 76b95cf contains a buffer overflow in the GetAttributeList() implementation for the EtherNet/IP Get_Attribute_List service. This allows a remote attacker to cause a denial of service
Executive ViewAI
The OpENer EtherNet/IP stack, used in industrial control and automation devices, contains a remotely reachable denial-of-service flaw that can crash systems running version 2.3 or master commit 76b95cf. Because an unauthenticated network attacker can trigger the crash through the EtherNet/IP service, any exposed device could become unavailable, disrupting monitoring, control, or production processes that rely on it. Leadership should treat this as an availability risk requiring immediate exposure reduction and vendor engagement, while noting that no public exploit identified at time of analysis.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict access to EtherNet/IP ports TCP/UDP 44818 and UDP 2222 to trusted networks, segment affected devices, disable unnecessary EtherNet/IP services, monitor for crash or reboot events, and apply vendor or maintainer workarounds if provided.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB