EUVD-2026-95900
GHSA-h42x-559x-q66g
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach EtherNet/IP TCP service (44818)
-
DeliverySend SendRRData with CPF
-
ExploitInclude truncated 0x8000/0x8001 sockaddr item
-
ExecutionTrigger out-of-bounds read in parser
-
ImpactCrash device (denial of service)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the OpENer EtherNet/IP service over TCP (SendRRData encapsulation, typically port 44818) and that the device parses a Common Packet Format containing a socket address information item of type 0x8000 or 0x8001 that is truncated so the remaining CPF buffer does not hold the complete fixed sockaddr structure; CreateCommonPacketFormatStructure() then reads past the buffer. No authentication or user interaction is needed (PR:N/UI:N). Limiting factors: the attacker must reach the EtherNet/IP port (often segmented on OT networks), the target must run the affected code (OpENer v2.3 through commit 76b95cf), and impact is confined to availability - a crash/DoS with no confidentiality or integrity effect. |
| Impact | Signals are moderately consistent and point to a genuine but bounded availability risk. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) describes a remotely reachable, low-complexity, unauthenticated flaw with impact limited strictly to availability (C:N/I:N) - consistent with the description's out-of-bounds read causing denial of service rather than code execution. No EPSS score, CISA KEV entry, or POC indicator was supplied in the input, so exploitation likelihood cannot be quantified: treat exploitation status as 'no public exploit identified at time of analysis.' The 'Buffer Overflow' tag is imprecise - the description specifies an out-of-bounds READ (boundary/crash), not a write-based overflow, so the realistic ceiling is a crash/DoS, not RCE. Net: this is a legitimately network-exploitable DoS against an OT protocol stack and should be patched, but in the absence of KEV/EPSS/POC evidence it is a high-CVSS availability issue rather than a confirmed actively-exploited priority; prioritize based on whether exposed EtherNet/IP devices run OpENer. |
| Exploit ScenarioDerived | A remote attacker with TCP reachability to an EtherNet/IP device running OpENer (typically port 44818) sends a crafted SendRRData request whose Common Packet Format contains a truncated socket address information item of type 0x8000 or 0x8001. Because CreateCommonPacketFormatStructure() reads the fixed sockaddr structure without verifying the remaining buffer length, the parser reads out of bounds and the device crashes, denying service to the controlled industrial process. No public exploit code was identified in the provided data, though GitHub issue #573 documents the flaw. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 09, 2026
An out-of-bounds read in EIPStackGroup's OpENer EtherNet/IP stack (v2.3 through master commit 76b95cf) allows remote, unauthenticated attackers to crash the service by sending a Common Packet Format message whose optional socket address information item (type 0x8000 or 0x8001) is truncated. The parser routine CreateCommonPacketFormatStructure() then reads a fixed-size sockaddr structure past the end of the supplied buffer, faulting the process - this is an availability-only impact with no confidentiality or integrity effect, consistent with the assessed CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). No public exploit code or active exploitation was identified at time of analysis, and practical risk is bounded by the requirement that the attacker reach the EtherNet/IP TCP service on the affected device.
RemediationAI
No vendor-released patch was identified in the available data for CVE-2026-75348; affected deployments should track the upstream project via issue https://github.com/EIPStackGroup/OpENer/issues/573 and the source files https://github.com/EIPStackGroup/OpENer/blob/master/source/src/enet_encap/cpf.c, https://github.com/EIPStackGroup/OpENer/blob/master/source/src/enet_encap/encap.c and https://github.com/EIPStackGroup/OpENer/blob/master/source/src/enet_encap/endianconv.c for a fix commit, and upgrade to a commit or release that validates the remaining CPF buffer length (at minimum, that the buffer holds the complete fixed sockaddr structure) before the 0x8000/0x8001 item is parsed. If the code cannot be rebuilt or updated promptly - the common situation for embedded OT firmware - apply compensating controls at the network layer: restrict TCP access to the EtherNet/IP encapsulation port (typically 44818) to authorized engineering workstations and controllers via firewall/ACL rules or an industrial DMZ, and block inbound connections from untrusted zones, accepting that this breaks legitimate remote programming and HMI/SCADA traffic from outside the allowed set; segment the control network so that only the zones that must speak EtherNet/IP can reach the device, with the trade-off of added architecture complexity and possible latency for routed traffic; and deploy protocol-aware IDS/IPS signatures that flag SendRRData packets with truncated 0x8000/0x8001 CPF items, understanding that such inspection must be located on a span/TAP because inline blocking can disrupt legitimate encapsulation traffic. Backporting the missing length check into a private firmware build is the most durable mitigation if vendor patching is delayed.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
OpENer is an open-source EtherNet/IP (Industrial Ethernet) adapter/target stack used in embedded industrial devices. EtherNet/IP encapsulation runs over TCP, conventionally on port 44818, and carries encapsulation commands such as SendRRData that embed a Common Packet Format (CPF) structure made up of typed items. Two optional item types, 0x8000 (socket address info, originator-to-target) and 0x8001 (socket address info, target-to-originator), carry a fixed-size socket address structure (in the common CPF usage a sockaddr-style record, typically 16 bytes for sockaddr_in: address family, port, 4-byte address, and padding). The defect lies in CreateCommonPacketFormatStructure() in source/src/enet_encap/cpf.c: when it recognizes a 0x8000/0x8001 item it dereferences the fixed sockaddr fields without first confirming that the remaining CPF buffer is long enough to contain that whole structure, so a truncated item drives a read beyond the received packet buffer; the referenced endianconv.c and encap.c files handle the value conversion and encapsulation layers where the truncated item is consumed. The input did not assign a CWE, but the issue class is an out-of-bounds read / missing length validation (CWE-125 / CWE-20) rather than a classic memory-corruption write; the supplied tag set ('Buffer Overflow', 'Denial Of Service') reflects the resulting crash/DoS. The provided CPE string (cpe:2.3:a:n/a:n/a:*:*:*:*:*:*:*) is a placeholder and does not constrain product identification, so affected scope must be taken from the description, the source-tree references, and upstream issue #573.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Remote unauthenticated crafted packet over EtherNet/IP with no interaction (AV:N/AC:L/PR:N/UI:N); out-of-bounds read yields DoS only, so C:N/I:N/A:H.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
DescriptionCVE.org
An out-of-bounds read vulnerability exists in EIPStackGroup OpENer v2.3 and master up to commit 76b95cf in the EtherNet/IP TCP SendRRData Common Packet Format parser. The issue occurs in CreateCommonPacketFormatStructure() when it parses recognized optional socket address information items of type 0x8000 or 0x8001 without first validating that the remaining CPF buffer contains the complete fixed sockaddr structure. This allows a remote attacker to cause a denial of service.
Executive ViewAI
A remotely reachable flaw in the OpENer EtherNet/IP stack that EIPStackGroup maintains for industrial devices lets an unauthenticated sender crash the protocol service with a single malformed packet, and no vendor patch is currently available. Any product or production line that embeds OpENer versions 2.3 through master commit 76b95cf and exposes the EtherNet/IP service on the network is potentially affected, so operations and engineering leadership should expect repeated service outages or control-system restarts rather than data theft. Because the impact is limited to availability and there is no public exploit code or confirmed exploitation today, the near-term priority is exposure reduction while engineering tracks remediation from the maintainers.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict and segment network access to the EtherNet/IP TCP service so only trusted engineering hosts can reach it, block the service at perimeter and OT zone firewalls, apply rate limiting or a protocol-aware proxy in front of exposed endpoints, deploy detection for malformed Common Packet Format messages (truncated optional socket address items of type 0x8000 or 0x8001) and for unexpected service restarts, and monitor affected assets for availability degradation while tracking maintainer remediation.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB