EUVD-2026-63347
GHSA-q8vh-mhmw-wmcq
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable unauthenticated OOB read with scope unchanged; only availability is impacted at low severity - no confidentiality or integrity consequence demonstrated.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
A security vulnerability has been detected in liftoff-sr CIPster 1802525be27d33e19a9a83c163e331a1d13b1892. This impacts an unknown function of the file source/src/enet_encap/encap.cc of the component TCP Encapsulation Receive Path. The manipulation leads to out-of-bounds read. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The identifier of the patch is e8e9dba09bf56962807d3504b783ccdb6287f3e4. To fix this issue, it is recommended to deploy a patch.
AnalysisAI
Out-of-bounds read in liftoff-sr CIPster's TCP Encapsulation Receive Path allows remote unauthenticated attackers to crash or disrupt EtherNet/IP adapter availability. The vulnerability in Encapsulation::ReceiveTcpMsg (encap.cc) causes the function to return a success-indicating length value after silently discarding an oversized TCP payload, prompting the caller to parse an already-discarded buffer and triggering the out-of-bounds read. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No authentication is required - the CVSS 4.0 vector (PR:N/UI:N/AV:N) confirms unauthenticated remote exploitation with no user interaction. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 base vector (AV:N/AC:L/AT:N/PR:N/UI:N) places this vulnerability in a high-severity attack-profile category: network-reachable, low complexity, unauthenticated, no user interaction required. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with network-layer access to a CIPster-based EtherNet/IP adapter (e.g., residing on the same OT network segment or reaching TCP port 44818 through a misconfigured firewall) sends a crafted TCP packet with an oversized EtherNet/IP encapsulation payload. The `ReceiveTcpMsg` function invokes `disposeOfLargePacket` to consume the body, then - in the pre-fix code path - mistakenly returns a positive length indicating a complete valid packet. … |
| Remediation | Apply the upstream patch at commit e8e9dba09bf56962807d3504b783ccdb6287f3e4 from the CIPster GitHub repository (https://github.com/liftoff-sr/CIPster/commit/e8e9dba09bf56962807d3504b783ccdb6287f3e4). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-119 – Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today