EUVD-2026-95970
GHSA-h7x2-h7jp-5m95
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach device on EtherNet/IP port (TCP/UDP 44818/2222)
-
ExploitSend crafted ForwardOpen request
-
ExecutionOut-of-bounds read in connection-path parser
-
ImpactService crash / denial of service
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to a device running OpENer's server-side EtherNet/IP stack with the ForwardOpen (connection manager) service exposed - i.e. the device must be accepting EtherNet/IP connection requests (typically TCP/UDP 44818 and CIP class 3/implicit messaging). No authentication, user interaction, or special privileges are needed (PR:N/UI:N), and default adapter configurations that accept ForwardOpen requests are vulnerable. The practical LIMITING factor is exposure: OpENer is an embedded industrial adapter stack normally deployed on segmented OT/ICS networks, so Internet-facing exploitation is unusual and an attacker generally needs a foothold on the operational network. Impact is confined to availability (service/device crash); there is no confidentiality or integrity effect per the scored vector. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5 HIGH) describes a remotely reachable, low-complexity, unauthenticated flaw with pure availability impact - consistent with the description of an out-of-bounds read causing denial of service in the EtherNet/IP ForwardOpen connection-path parser. The SSVC decision framework reinforces this: Exploitation=poc (so publicly available exploit code exists, but NOT confirmed active exploitation), Automatable=yes (the ForwardOpen handshake can be scripted and fired at scale), and Technical Impact=partial (a crash/DoS rather than full system compromise). This is NOT a CISA KEV entry, so there is no evidence of in-the-wild exploitation; it should be treated as a credible-but-not-emergency priority. No EPSS score was provided, so statistical exploitation probability cannot be weighed. CONFLICT TO VERIFY: the CWE is CWE-125 (out-of-bounds READ) and one tag claims 'Information Disclosure', yet the CVSS confidentiality metric is C:N and the description names only denial of service - the read appears to crash the service rather than leak memory to the attacker, so the information-disclosure framing is not supported by the scored impact. Overall this is a real, easily-automatable remote DoS against an industrial protocol stack, but limited to availability. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker with network reachability to a device running the OpENer EtherNet/IP adapter sends a crafted ForwardOpen request whose connection-path field is malformed. The server-side parser reads past the bounds of the supplied buffer, triggering a crash that takes the EtherNet/IP service (and potentially the embedded device) offline. SSVC indicates proof-of-concept exploit code exists and that the attack is automatable, so it can be repeated or scaled against many exposed endpoints. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 09, 2026
Remote denial of service affects devices running the OpENer server-side EtherNet/IP adapter stack (v2.3, up to and including commit 76b95cf), where an out-of-bounds read in the ForwardOpen connection-path parser can crash the service. The flaw is reachable over the network with no authentication, privileges, or user interaction required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5 HIGH), and publicly available exploit code exists; there is no CISA KEV listing and no confirmed active exploitation, so the practical risk is driven by exposure of EtherNet/IP endpoints on reachable networks. CISA's SSVC assessment rates the issue automatable with partial technical impact, consistent with an unauthenticated crash of an embedded industrial adapter rather than a full compromise.
RemediationAI
No vendor-released patch identified at time of analysis: the only references supplied are the upstream OpENer repository (https://github.com/EIPStackGroup/OpENer) and issue 574 (https://github.com/EIPStackGroup/OpENer/issues/574), neither of which confirms a tagged fixed release or an exact fix version, so remediation should begin by monitoring that issue and the repository for an upstream commit or version bump and, once identified, upgrading to the first release containing the corrected ForwardOpen path-length validation. Until then, apply compensating controls targeted at the exposed parser: block inbound TCP/UDP 44818 and other EtherNet/IP class 3/implicit messaging traffic from untrusted networks with host or perimeter firewalls, and restrict it to known controller/engineering workstations on a segmented OT network - the trade-off is loss of legitimate cross-zone CIP connectivity and added firewall rule management. Where an EtherNet/IP-aware firewall or deep-packet-inspection device is available, drop or rate-limit malformed ForwardOpen requests and connection paths that exceed expected lengths; this can be implemented without disrupting valid traffic but depends on vendor signature support and may miss crafted edge cases. Disabling or gating the ForwardOpen connection manager service, or restricting the adapter to a single trusted peer, removes the attack surface entirely but breaks class 3 explicit connections and implicit I/O messaging, which is unacceptable for most production cells. Because the impact is a crash, deploy process watchdogs and automatic restart with alerting on repeated restarts to limit outage duration, and monitor for repeated ForwardOpen disconnects, malformed EPATH payloads, or unexpected stack restarts as indicators of attempted exploitation.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the Connection Manager handling of the EtherNet/IP ForwardOpen service, part of the Common Industrial Protocol (CIP) suite that OpENer implements for industrial adapters. ForwardOpen carries a variable-length connection path (an EPATH/segment structure) that the server must parse before establishing a class 3 explicit or implicit messaging connection; the parser trusts the length of that path and performs the read without adequate bounds validation, which is the root cause class CWE-125 (Out-of-bounds Read). Reading past the end of the supplied buffer causes the embedded stack to fault, essentially crashing the adapter or the process hosting it, matching the scored impact of pure availability loss (C:N/I:N/A:H). The accompanying metadata tags 'Buffer Overflow' and 'Information Disclosure' suggest the out-of-bounds access could in principle touch adjacent memory, but the authoritative assessment and scored vector confirm availability-only impact, so confidentiality or integrity effects should not be assumed. The service is normally exposed on the EtherNet/IP port (typically TCP/UDP 44818) plus CIP class 3/implicit messaging endpoints, and the supplied CPE string is a placeholder (n/a:n/a), so exact product/version enumeration must come from the vendor repository rather than automated CPE matching.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Remote unauthenticated ForwardOpen request (AV:N/AC:L/PR:N/UI:N) triggers an OOB read crash with availability-only impact (A:H); no data is returned to the attacker, so C:N/I:N.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
OpENer v2.3/commit 76b95cf, contains an out-of-bounds read in the server-side EtherNet/IP ForwardOpen connection-path parser. This allows a remote attacker to cause a denial of service.
Executive ViewAI
The OpENer EtherNet/IP adapter stack (v2.3 up to commit 76b95cf) contains a high-severity remote denial-of-service vulnerability that can crash industrial devices, disrupting operational technology networks. Because the flaw is unauthenticated and reachable over the network, any organization with exposed EtherNet/IP endpoints-particularly in manufacturing, energy, and utilities-faces potential unplanned downtime. Leadership should prioritize immediate exposure reduction and vendor engagement, as no vendor-released patch identified at time of analysis.
No vendor-released patch identified at time of analysis. Interim mitigations include network segmentation, firewall rules restricting access to EtherNet/IP ports (TCP/44818/UDP/2222), disabling unused services, monitoring for service crashes, and applying vendor-provided workarounds if any.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB