CIPster CVE-2026-76988

No authentication or prior session establishment is required: the CIP ForwardOpen service is an unauthenticated standard EtherNet/IP service accessible to any network peer on port 44818, which is the default operational mode for EtherNet/IP adapter and scanner devices. The attack is limited to hosts running liftoff-sr CIPster at or before commit 1802525be27d with the ForwardOpen handler exposed on a reachable network interface. No operator interaction, no non-default configuration, and no elevated privileges on the target device are needed. The primary limiting factor for defenders is network segmentation: the vulnerability requires direct IP reachability to port 44818, so devices behind properly enforced OT network perimeters or unidirectional security gateways are not reachable to external attackers. The CVSS 4.0 vector confirms no attack requirements (AT:N) beyond network access.

The CVSS 4.0 base score of 5.5 with vector AV:N/AC:L/AT:N/PR:N/UI:N reflects a remotely exploitable, unauthenticated attack with no special preconditions, but limits impact to low availability (VA:L) with no confidentiality or integrity impact per the CNA's assessment. The CNA's assignment of VC:N may understate realistic risk: out-of-bounds reads in network-facing C++ code frequently expose adjacent heap or stack memory, and a more conservative assessment would assign C:L. The E:P supplemental metric confirms a public proof-of-concept exists, meaningfully lowering the skill threshold for exploitation despite the moderate base score. The absence of a CISA KEV listing suggests no confirmed, widespread active exploitation at time of analysis - even a mid-sized industrial operator in malbork running CIPster-based EtherNet/IP devices should treat this as a priority patch given the zero-barrier network attack vector and public exploit availability. EPSS data was not present in the provided intelligence, so probability-based prioritization metrics cannot be compared against the CVSS signals here.

A remote attacker with network reachability to port 44818 on a device running unpatched CIPster crafts an EtherNet/IP ForwardOpen request that specifies a consuming or producing connection path pointing to a CIP instance of a non-Assembly class - for example, a CIP Identity or Message Router object - with a manipulated product_code_ value. The unpatched ResolveInstances function processes the path without verifying the instance class, causing an out-of-bounds read that corrupts or crashes the CIPster process and severs the device's EtherNet/IP connectivity. A public proof-of-concept is confirmed by the E:P exploitation metric and VulDB issue tracker reference, reducing attacker skill requirements.