SOEM EUVD-2026-109669

The attacker must operate as (or have compromised) a device on the same EtherCAT network segment served by a SOEM-based master running version 2.0.0 or earlier - EtherCAT is an Adjacent-network fieldbus, so this is NOT exploitable over the public internet (AV:A). The specific trigger is a device response message whose length field exceeds the true payload size; SOEM uses that device-supplied length value without validating it against the actual buffer size, causing the master to over-read. No authentication is required (PR:N - EtherCAT lacks native device authentication) and no user interaction is needed (UI:N). The principal limiting factor is the adjacency/physical-or-logical-foothold requirement on the fieldbus; the flaw otherwise affects the product as described without a special feature or non-default configuration being named in the available data. Impact is read-only disclosure of up to 64KB of master memory - no write/integrity or availability effect is described.

This is a genuine but contained risk, best characterized as medium rather than a drop-everything emergency. The CVSS base score of 6.5 is driven entirely by confidentiality (C:H, I:N, A:N) and, critically, by an Adjacent attack vector (AV:A): the attacker must be a device on the same EtherCAT fieldbus segment, not a remote internet host, which sharply narrows the realistic attacker population to someone who has already placed or compromised a device on the industrial network. Low attack complexity (AC:L) and no authentication (PR:N, consistent with EtherCAT having no native device authentication) mean that once that foothold exists, the over-read is reliably triggerable. The vuln.today decision label is 'this_month', not 'act_now' or 'emergency', aligning with the moderate severity. No EPSS score was supplied, this CVE is NOT in CISA KEV, and no PoC or exploit reference is present in the input, so there is no signal of active or probable near-term widespread exploitation. The signals are therefore consistent rather than conflicting: a real, patch-this-cycle issue whose impact is information disclosure from a physically/logically constrained position, not a wormable remote-code-execution threat. Note that EPSS is simply absent (not low) - absence should not be read as a low-probability finding.

An attacker who controls or has compromised a slave device on an EtherCAT segment managed by a SOEM master sends crafted response messages containing length fields larger than the real payload. The SOEM master trusts these attacker-supplied length values without bounds-checking them against the actual buffer, causing it to read and return adjacent heap/stack memory - up to 64KB per the advisory - potentially leaking cryptographic material, credentials, or process data. No public exploit code is identified in the available data, and exploitation requires adjacency to the fieldbus rather than remote internet access.