SOEM EUVD-2026-109679

The attacker must be a device on the same EtherCAT network segment as the SOEM master (Adjacent vector, AV:A) - this is a fieldbus/OT-network precondition, not remote Internet reachability. No authentication or user interaction is required (PR:N/UI:N). The concrete trigger is a two-step message sequence: a malicious device first sends an error response (causing SOEM to clear an internal pointer while continuing to process), then sends a second message before the timeout expires so the master uses the cleared pointer, producing a NULL dereference crash. Limiting factors: affected only in SOEM version 2.0.0 and earlier, impact is availability/DoS only (no code execution or data access), and reachability is bounded to the local EtherCAT bus rather than arbitrary networks.

This is a medium-severity availability-only flaw (CVSS 6.5, CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) whose single most important real-world limiter is the Adjacent attack vector: exploitation requires the attacker to already be a device on the same EtherCAT fieldbus segment as the SOEM master, not a remote Internet attacker. Against that position the barrier is low - PR:N means no authentication and AC:L plus the description's 'simple sequence of two messages' indicate reliable triggering with no race-grooming or special timing skill, since the attacker controls both the error response and the follow-up message sent before timeout. Impact is confined to availability (C:N/I:N/A:H): a crash/DoS of the master, with no code execution or data exposure claimed. Threat-intel signals are weak-to-absent: no EPSS score is provided, KEV status is NO (not CISA-listed), and no public exploit or PoC reference is present - only a vendor advisory PDF. The vuln.today priority is 'this_month', consistent with a genuine but non-emergency OT availability issue rather than an act-now crisis. Net: a credible, easy-to-trigger DoS for anyone already on the industrial bus, but the adjacent-only reachability and availability-only impact keep it a scheduled-patch priority rather than a drop-everything event.

An attacker controlling or impersonating a malicious device on the EtherCAT network sends an error response to the SOEM master, which clears an internal pointer but continues processing. Before the timeout elapses the attacker sends a second message, causing the master to dereference the now-cleared (NULL) pointer and crash, denying control of the EtherCAT segment. No public exploit identified at time of analysis; only a vendor advisory is referenced.