CIPster EUVD-2026-63322

The target device must be running an unpatched CIPster build (at or before commit 1802525be27d33e19a9a83c163e331a1d13b1892) with at least one CIP object that exposes a kCipByteArray or kCipByteArrayLength attribute as writable via the EtherNet/IP explicit messaging service. The CVSS PR:N rating confirms no authentication is required - the attack is fully unauthenticated. The attacker must have network reachability to the EtherNet/IP port (typically TCP 44818) of the target device. Exploitation is limited by network segmentation: devices isolated behind industrial DMZs or OT firewalls with no external connectivity have substantially reduced exposure. The vulnerable code path is reached only through the generic attribute decode handler, not through specialized attribute setters that use their own validation logic.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates unauthenticated remote exploitation with no special attack requirements - a high-risk combination for any industrial protocol stack. The CIA impact scores are each rated Low (VC:L/VI:L/VA:L) in the provided vector, yielding a base score of 6.9, but this may understate the real-world severity in OT environments where device availability is safety-critical and memory corruption can escalate from low-impact crashes to full code execution depending on heap layout. No EPSS score was provided in the input data, so probabilistic exploitation likelihood cannot be quantified. The E:P exploit maturity modifier confirms a public proof-of-concept exists, meaningfully lowering the technical bar for attackers. The vulnerability is not listed in CISA KEV, so confirmed active exploitation in production environments has not been officially reported. Risk is highest for deployments where CIPster-based devices are reachable from untrusted segments - industrial network segmentation substantially reduces exposure. The CPE wildcard covering all versions means there is no safe prior release to fall back to without applying the patch.

An attacker with network access to the EtherNet/IP interface of a CIPster-based device sends a crafted explicit messaging Set_Attribute_Single service request targeting a kCipByteArray or kCipByteArrayLength generic attribute, embedding a wire-supplied length value that exceeds the physical capacity of the registered backing buffer. The unpatched DecodeData function writes past the buffer boundary, corrupting adjacent heap or stack memory; depending on allocator layout, this can result in a device crash (denial of service) or arbitrary code execution. A public proof-of-concept demonstrating this behavior is referenced at GitHub issue #47 (https://github.com/liftoff-sr/CIPster/issues/47).