RT-Labs C-Open EUVD-2026-91024

No authentication is required because the CANopen protocol provides no built-in authentication and the flaw is PR:N; however, exploitation requires adjacent access to the CAN bus (AV:A) - the attacker must be or control a node on the same CAN segment, which is the primary limiting factor and typically implies physical or local network proximity to the device. The specific technical prerequisite is the ability to send SDO frames to the target node's SDO server: first an SDO upload request targeting a read-only Object Dictionary entry (to point the data pointer at protected memory), then SDO download-segment frames. The root cause is that the download-segment handler does not verify an active download session, so exploitation works against default configurations of C-Open versions before 1.1.1 with no special feature flag required. There is no required user interaction and no non-default setting needed.

This is a genuine but access-gated integrity issue, not a remotely-wormable critical. The CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N) correctly reflects that exploitation requires adjacent access to the CAN bus rather than Internet reachability - there is no AV:N network path. Impact is scoped to integrity only (VI:H, with VC:N and VA:N), consistent with CWE-863 improper authorization: an attacker can overwrite read-only Object Dictionary entries but gains no confidentiality or direct availability loss from this flaw alone. PR:N is accurate because CANopen itself provides no authentication, so any node on the bus qualifies as unauthenticated. No EPSS score, no CISA KEV listing, and no public exploit were provided in the input, so there is no signal of active or probable near-term exploitation - exploitation status is therefore 'no public exploit identified at time of analysis.' The score of 7.1 is driven almost entirely by the trivial attack complexity and lack of authentication once bus access exists; the real-world gating factor is physical/logical access to the CAN segment, which in most industrial/embedded deployments is a meaningful barrier. Net: prioritize patching for exposed or bridged CAN environments, but this is not an Internet-facing emergency.

An attacker with access to the CAN bus (e.g., a malicious or compromised CANopen node) initiates an SDO upload request against a read-only Object Dictionary entry, causing the server to set its internal data pointer to that read-only object. The attacker then sends SDO download-segment frames, which the server processes without verifying that a write-capable download session is active, writing attacker-controlled data over the protected memory. No public exploit code was identified at time of analysis, and the attack needs only two SDO frames against a default configuration.