CIPster CVE-2026-76989

No authentication is required - the CVSS 4.0 vector (PR:N/UI:N/AV:N) confirms unauthenticated remote exploitation with no user interaction. The sole prerequisite is TCP connectivity to the CIPster EtherNet/IP listener on port 44818. The attacker must craft an EtherNet/IP encapsulation packet whose declared payload size causes the receiver to enter the disposeOfLargePacket code branch - specifically a packet that exceeds the expected encapsulation body size thresholds checked in ReceiveTcpMsg. In typical industrial deployments, EtherNet/IP devices reside on isolated OT network segments, providing network-level segmentation as a de facto limiting factor; however, any CIPster device directly reachable over TCP without additional access controls is exploitable without credentials. Impact is limited to availability - no code execution, credential theft, or data exfiltration has been demonstrated or implied by the CVSS metrics or commit diff.

The CVSS 4.0 base vector (AV:N/AC:L/AT:N/PR:N/UI:N) places this vulnerability in a high-severity attack-profile category: network-reachable, low complexity, unauthenticated, no user interaction required. However, the impact metrics are constrained exclusively to availability at low severity (VA:L) with no confidentiality or integrity impact (VC:N/VI:N), yielding a moderate overall score of 5.5. The E:P supplemental metric confirms a proof-of-concept exploit has been publicly disclosed, reducing the skill bar for exploitation. No EPSS score was provided in the input data and CISA KEV status is not indicated, leaving active exploitation unconfirmed. In operational technology (OT) and industrial control system (ICS) environments where CIPster is deployed, even low-severity availability disruptions can have disproportionate operational consequences - crashing an EtherNet/IP adapter may halt communication with a connected PLC or actuator. The absence from KEV and the VA:L impact rating together suggest this is not currently being exploited at scale, but the OT deployment context and public POC existence elevate it above a typical low-priority finding for asset owners running CIPster.

An attacker with network-layer access to a CIPster-based EtherNet/IP adapter (e.g., residing on the same OT network segment or reaching TCP port 44818 through a misconfigured firewall) sends a crafted TCP packet with an oversized EtherNet/IP encapsulation payload. The ReceiveTcpMsg function invokes disposeOfLargePacket to consume the body, then - in the pre-fix code path - mistakenly returns a positive length indicating a complete valid packet. The caller reads past the end of the now-empty buffer, causing an out-of-bounds memory access that crashes the adapter process and disrupts EtherNet/IP communication. A proof-of-concept demonstrating this path has been publicly disclosed per VulDB and the CVSS 4.0 E:P metric.