RT-Labs C-Open EUVD-2026-91022

Exploitation requires three concrete conditions: (1) the attacker must have access to the CAN bus (adjacent access, e.g., through a compromised node) - this is not internet-reachable; (2) the target C-Open device must have a user-application-defined identity object 0x1018 that is MISSING one or more required subindexes (a misconfiguration - correctly configured identity objects are not affected); and (3) the attacker must be able to initiate the LSS (Layer Setting Services) protocol against that device. No authentication is required (PR:N) and no user interaction is needed. Limiting factors that reduce real-world risk: the adjacent (bus-local) attack vector, the dependency on a non-default/misconfigured identity object, and availability-only impact (crash, no data compromise or code execution).

This is a genuine but bounded denial-of-service issue, not a critical widespread threat. The provided CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N) scoring 7.1 is internally consistent with the description: exploitation is unauthenticated and low-complexity but requires ADJACENT access - specifically presence on the CAN bus - rather than true internet-facing network reach, which substantially narrows the attacker population to those who already have a foothold on the bus (e.g., via a compromised node, as the description explicitly states). Impact is availability-only (VC:N/VI:N/VA:H, CWE-476 NULL pointer dereference → device crash); there is no confidentiality or integrity loss and no code execution. No EPSS score, KEV listing, or POC was provided in the input, and there is no public exploit identified at time of analysis, so there is no evidence of active or automated exploitation. A key limiting condition dampens real risk further: the target device must have a misconfigured identity object (0x1018) lacking required subindexes, so default/correctly-configured devices are not affected. Net: a legitimate patch-worthy DoS for CAN/CANopen operators, but 'high CVSS with real-world risk gated by bus access and a configuration precondition' rather than an urgent broad-exposure emergency.

An attacker who has compromised one node on a CANopen network (or otherwise gained CAN bus access) targets a C-Open device whose user application defined identity object 0x1018 without all required subindexes. The attacker initiates the LSS (Layer Setting Services) configuration protocol against that device, triggering a NULL pointer dereference that crashes the device and causes a denial of service. No public exploit code is identified at time of analysis.