SOEM CVE-2026-82947

Requires an attacker-controlled or compromised device on the same EtherCAT network segment as the SOEM master (AV:A, a Layer-2 fieldbus, not routable from the internet). The specific trigger is SOEM's frame-processing path consuming length and offset values from incoming device messages without validating them against buffer sizes; sending a frame with crafted length/offset values is sufficient. No authentication or user interaction is needed (PR:N/UI:N), consistent with EtherCAT having no device authentication. Affected: SOEM 2.0.0 and earlier. Principal limiting factor is access to the EtherCAT segment itself - these are typically isolated OT control networks, so realistic risk depends on whether an untrusted or spoofable device can join the bus; the fixed/upgrade version should be taken from the rt-labs advisory, which was not retrieved here.

This is a genuine but bounded industrial/OT priority rather than an internet-wide emergency. The CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N) scoring 7.1 shows the key constraint: exploitation is Adjacent, not Network - the attacker needs a presence on the EtherCAT fieldbus segment (a malicious or compromised slave device), not remote internet reach. Within that segment, however, no authentication (PR:N), no user interaction (UI:N) and low complexity (AC:L) make triggering trivial for any device already on the bus, which matches how fieldbus protocols like EtherCAT operate (no built-in device authentication). Impact is primarily confidentiality (C:H, out-of-bounds read of master memory) plus a potential crash (A:L); there is no integrity impact (I:N) because this is a read primitive (CWE-125). The vuln.today decision label is 'this_week' (not act_now/emergency). EPSS is not provided, there is no CISA KEV listing, and no public exploit or PoC reference is present - so there is no signal of active or widespread exploitation. Net: treat as a prompt patch item for environments running SOEM-based EtherCAT masters, weighted by whether the EtherCAT segment can plausibly contain an untrusted device. No conflicting signals across sources; the main gap is the absence of EPSS/KEV data (expected for a freshly disclosed OT library flaw).

An attacker who can place a malicious device on the EtherCAT network segment - or who compromises an existing slave device - sends crafted EtherCAT frames containing length and offset fields that the SOEM master uses without bounds checking. When the master processes these frames it reads beyond the allocated buffer, leaking adjacent memory contents back toward the attacker-observable path or crashing the master process. No public exploit or PoC is identified at time of analysis; exploitation requires adjacent (fieldbus) access, which limits opportunistic attacks.