What is the CVSS score of EUVD-2026-42503?

EUVD-2026-42503 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Which versions of OpENer are affected by EUVD-2026-42503?

OpENer 2.3.0, an open-source EtherNet/IP communication stack deployed in industrial automation environments, contains an unauthenticated remote denial-of-service vulnerability (CVE-2026-51535) that…

How to fix or mitigate EUVD-2026-42503?

Within 24 hours: Identify and catalog all systems running OpENer 2.3.0 (commit 76b95cf); assess network exposure and production criticality. Within 7 days: Deploy network segmentation via firewall rules to restrict unauthenticated access to affected devices; implement rate-limiting and DoS mitigation on network ingress points. Within 30 days: Establish communication with OpENer maintainers to confirm patch timeline; develop upgrade plan with target deployment within 90 days of vendor patch release; formalize interim compensating control acceptance if patches are delayed.

OpENer EUVD-2026-42503

| CVE-2026-51535 HIGH

Uncontrolled Resource Consumption (CWE-400)

2026-07-08 cve@mitre.org

GHSA-c2q6-qqhw-6ggr

Denial Of Service

7.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Network-reachable, unauthenticated, low-complexity DoS in the core processing loop with availability-only impact; no confidentiality or integrity effect, so C:N/I:N/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 09, 2026 - 16:45 vuln.today

CVSS changed

Jul 09, 2026 - 16:22 NVD

7.5 (None) 7.5 (HIGH)

CVE Published

Jul 08, 2026 - 22:17 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In OpENer 2.3.0 (commit 76b95cf), a resource exhaustion (Denial of Service) vulnerability exists in its network processing loop.

AnalysisAI

Remote denial of service in OpENer 2.3.0 (commit 76b95cf), an open-source EtherNet/IP (CIP) communication stack, lets unauthenticated network attackers exhaust device resources through the network processing loop, rendering the affected industrial device unavailable. The flaw carries CVSS 7.5 (availability-only impact) and publicly available exploit code exists (referenced GitHub gist and issue #562), though it is not listed in CISA KEV and EPSS is low at 0.20% (10th percentile), indicating no observed widespread exploitation. Because OpENer typically runs on embedded ICS/IIoT endpoints, loss of availability can translate directly to loss of process visibility or control.

Technical ContextAI

OpENer is a widely-referenced open-source implementation of the ODVA EtherNet/IP and Common Industrial Protocol (CIP) stack, used to embed EtherNet/IP adapter/server functionality into industrial devices and PLC-adjacent controllers over TCP/UDP port 44818 (and UDP 2222 for I/O). The root cause is CWE-400 (Uncontrolled Resource Consumption): the stack's network processing loop can be driven to consume unbounded resources (e.g., sockets, memory, or CPU/connection state) faster than they are released, degrading or halting the service. Because the defect lives in the core packet/connection handling path rather than an optional feature, any device exposing the OpENer network listener is potentially reachable. The specific triggering condition (connection flooding vs. a single malformed request) is not detailed in the available data and should be confirmed against GitHub issue #562.

RemediationAI

No vendor-released patched version is identified in the available data - EUVD lists affected versions as 'n/a' and the references point to an open issue (#562) rather than a tagged release, so track https://github.com/EIPStackGroup/OpENer/issues/562 for an upstream fix and rebuild embedded firmware once a patched commit is published. As compensating controls in the interim, restrict network reachability of the OpENer service: place affected devices on an isolated OT/ICS VLAN and firewall EtherNet/IP ports (TCP/UDP 44818, UDP 2222) so only trusted engineering hosts and controllers can connect, which eliminates unauthenticated internet/enterprise-side exposure but does not protect against a compromised in-segment host. Apply per-source connection rate-limiting or connection caps at an OT firewall/IPS in front of the device to blunt resource-exhaustion flooding, accepting that aggressive limits may drop legitimate high-frequency CIP traffic. Monitor for abnormal connection volumes to port 44818 and have a device restart/watchdog procedure ready, since recovery from the DoS may require a device reset. Review the referenced advisories (VulDB 377047, NVD) before deploying any change to production control systems.