EUVD-2026-63322
GHSA-wp3c-7fhf-vm5h
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable, unauthenticated, no-interaction attack; availability raised to High reflecting OT device crash risk from heap corruption, while C and I remain Low absent confirmed full exploitation.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
A security flaw has been discovered in liftoff-sr CIPster 1802525be27d33e19a9a83c163e331a1d13b1892. The impacted element is the function CipAttribute::GetAttrData/CipAttribute::SetAttrData of the file ciptypes.h of the component Generic Attribute Logic. Performing a manipulation results in memory corruption. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. The patch is named e745d9d4a8ca3a13689066983a1269fe1e567674. It is suggested to install a patch to address this issue.
AnalysisAI
Memory corruption in liftoff-sr CIPster's generic attribute logic exposes EtherNet/IP-connected devices to remote buffer overrun attacks requiring no authentication. The vulnerability exists in the CipAttribute::SetAttrData decode path, where the prior ByteBuf-based design tracked only a {start, limit} view of byte-array backing buffers without recording physical capacity - allowing a wire-supplied length value to direct writes beyond the allocated memory region. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The target device must be running an unpatched CIPster build (at or before commit 1802525be27d33e19a9a83c163e331a1d13b1892) with at least one CIP object that exposes a kCipByteArray or kCipByteArrayLength attribute as writable via the EtherNet/IP explicit messaging service. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates unauthenticated remote exploitation with no special attack requirements - a high-risk combination for any industrial protocol stack. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with network access to the EtherNet/IP interface of a CIPster-based device sends a crafted explicit messaging Set_Attribute_Single service request targeting a kCipByteArray or kCipByteArrayLength generic attribute, embedding a wire-supplied length value that exceeds the physical capacity of the registered backing buffer. The unpatched DecodeData function writes past the buffer boundary, corrupting adjacent heap or stack memory; depending on allocator layout, this can result in a device crash (denial of service) or arbitrary code execution. … |
| Remediation | Apply the upstream fix at commit e745d9d4a8ca3a13689066983a1269fe1e567674 from the liftoff-sr/CIPster repository (https://github.com/liftoff-sr/CIPster/commit/e745d9d4a8ca3a13689066983a1269fe1e567674). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-119 – Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today