EUVD-2026-95972
GHSA-fgff-hw4c-vx3q
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach device EtherNet/IP service (TCP 44818)
-
ExploitSend crafted ForwardOpen with malformed connection path
-
ImpactTrigger integer underflow crashing ENIP stack (DoS)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Integer underflow checks
|
| Exploitation Conditions | The target must be a device running the vulnerable OpENer EtherNet/IP adapter/server (v2.3 or commit 76b95cf) with its ENIP service reachable by the attacker (typically TCP 44818). Exploitation abuses the CIP ForwardOpen connection-establishment service, which is core default functionality of an ENIP adapter - no special non-default configuration or feature toggle is required, and because EtherNet/IP has no built-in authentication (vector PR:N/UI:N), no credentials or user interaction are needed. The primary limiting factor is reachability: OpENer runs on industrial field/adapter devices that are usually on segmented OT networks, so real exposure depends on whether an attacker can route to the device's ENIP port; impact is limited to availability (device/process crash), with no data exposure or code execution indicated. |
| Impact | Signals point to a genuine but bounded availability threat rather than a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) correctly reflects a remote, unauthenticated, low-complexity denial of service with impact confined to availability only - there is no confidentiality or integrity loss. EPSS is low at 0.19% (8th percentile), the CVE is NOT on the CISA KEV list, and no public exploit code is identified in the provided data, so there is no current evidence of weaponization or active exploitation. Mapped to SSVC-style reasoning: exploitation = none observed, technical impact = partial (DoS, not code execution), and automatable exploitation is plausible given PR:N/UI:N but there is no proof of mass scanning. The signals are internally consistent: a high-CVSS-but-low-EPSS DoS in a niche industrial stack. The practical caveat is context - although AV:N implies internet-style reachability, OpENer runs on EtherNet/IP adapter/field devices that are normally on segmented OT networks, so real-world exposure depends heavily on network architecture. Net: prioritize patching for exposed or flat OT networks, but this is not a drop-everything issue absent reachability. |
| Exploit ScenarioDerived | A remote attacker with network reachability to an industrial device running the vulnerable OpENer EtherNet/IP stack sends a crafted CIP ForwardOpen request whose connection-path field triggers an integer underflow in the server-side parser. The resulting out-of-bounds or miscomputed length crashes or hangs the ENIP stack, knocking the device offline and disrupting the controlled process. No public exploit code is identified at time of analysis, and no authentication or user interaction is required. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
An integer underflow in OpENer's server-side EtherNet/IP ForwardOpen connection-path parser lets an unauthenticated remote attacker crash the affected adapter, causing a denial of service. OpENer v2.3 and commit 76b95cf are affected; exploitation requires only that the ENIP/CIP service (typically TCP 44818) be reachable, since the vector is AV:N/AC:L/PR:N/UI:N with availability-only impact (C:N/I:N/A:H). No public exploit code identified at time of analysis and no KEV listing; EPSS is low at 0.19% (8th percentile), so the practical risk is bounded by how exposed the device's ENIP port is on the network.
RemediationAI
No vendor-released patch identified at time of analysis, so remediation must lean on exposure reduction until an upstream fix lands; monitor https://github.com/EIPStackGroup/OpENer and issue 571 for a corrected release or commit, and treat any downstream OEM firmware update as the authoritative fix once published. The most effective compensating control is restricting reachability of the ENIP service - block TCP/UDP 44818 (and 2222 for explicit messaging where used) at OT/IT boundaries and between zones with a firewall or ACL, since the attack requires the adapter's ENIP port to be routable; the trade-off is that any legitimate CIP client outside the permitted segments loses connectivity until it is explicitly whitelisted. Where the device is not required to act as an EtherNet/IP adapter in a given deployment, disabling or firewalling the ENIP listener entirely removes the attack surface, at the cost of losing CIP communications for that device. Additional measures: segment field devices onto isolated OT VLANs with no direct internet or enterprise routing, apply CIP-aware intrusion detection to flag anomalous or malformed ForwardOpen requests, and rate-limit or drop oversized/malformed connection-path payloads at the perimeter where a CIP-aware gateway is available. Because the failure mode is a denial of service rather than code execution, redundancy and automatic restart/watchdog strategies can reduce process downtime, but they do not prevent the crash itself and should not be treated as a fix.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
OpENer is an open-source EtherNet/IP (ENIP) adapter/server stack widely reused in industrial field devices that speak CIP over TCP/UDP. The flaw is an integer underflow (CWE-191) in the parsing logic that processes the connection path carried by the CIP ForwardOpen service, the standard mechanism used to establish an implicit or explicit connection to an adapter. Because ForwardOpen is core, default, always-on functionality of an ENIP adapter, there is no special feature toggle an operator must have left enabled for the parser to be reached; the underflow leads to memory/state misuse that manifests as a crash rather than code execution or data disclosure. The vulnerability class is arithmetic on an attacker-influenced length or offset field that wraps below zero before being used in bounds or copy operations. The supplied CPE string (cpe:2.3:a:n/a:n/a:*) is a placeholder and carries no version or vendor precision, so product and version identification must come from the EUVD data, which lists OpENer v2.3 and commit 76b95cf. EtherNet/IP itself provides no built-in authentication, which is why the assessed vector is PR:N/UI:N.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
ForwardOpen is an unauthenticated network CIP service with no UI (AV:N/AC:L/PR:N/UI:N); the integer underflow only crashes the stack, so C:N/I:N/A:H.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
OpENer v2.3/commit 76b95cf, contains an integer underflow in the server-side EtherNet/IP ForwardOpen connection-path parser. This allows a remote attacker to cause a denial of service
Executive ViewAI
A remotely reachable flaw in OpENer's EtherNet/IP connection-path parser (CVE-2026-75352) allows any host that can reach TCP 44818 to crash the affected adapter without credentials, creating an availability risk for industrial control assets that rely on that adapter. Because no vendor patch exists yet and the impact is a hard denial of service rather than data theft, the immediate concern is unplanned production or process downtime wherever OpENer is exposed beyond a trusted control network. Leadership should care because affected devices are typically embedded in OT environments where uptime directly maps to operational and revenue impact.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict TCP 44818 to trusted engineering hosts via firewall/ACL, segment OpENer-based adapters into isolated OT zones with no internet exposure, disable ENIP/CIP where not operationally required, deploy IDS/IPS signatures for malformed ForwardOpen connection-path traffic, monitor and alert on unexpected service restarts or device reboots, and track the vendor advisory for a fixed version covering v2.3 and commit 76b95cf.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB