EUVD-2026-95901
GHSA-9w4r-w48h-rx76
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach OpENer EtherNet/IP server on network
-
ExploitSend crafted CIP SetAttributeList request
-
ExecutionTrigger out-of-bounds read in parser
-
ImpactCrash stack causing denial of service
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires network reach to an OpENer-based device running its CIP/EtherNet/IP server and accepting the SetAttributeList service; exploitation is a single crafted SetAttributeList request against the default server behavior, with no authentication, user interaction, or non-default configuration needed. Affected builds are OpENer v2.3 and the master branch through commit 76b95cf. The practical limiting factor is reachability: these are embedded industrial controllers typically deployed on segmented OT networks, so exposure depends on network access to the device rather than on any special product setting. |
| Impact | This is a genuine but bounded availability risk, not a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a remotely reachable, low-complexity, unauthenticated flaw, which aligns well with OpENer's role as an EtherNet/IP server that accepts unauthenticated CIP requests on the network - so the network/unauthenticated framing is credible. However, impact is strictly availability (C:N/I:N/A:H): the CWE-125 out-of-bounds read causes a denial of service only, with no code execution or data theft established, which correctly caps severity at 7.5 rather than critical. No EPSS score, KEV listing, or SSVC decision data was provided, and no public exploit is referenced, so exploitation probability cannot be quantified from the inputs. A conflict to note: the input Tags include 'Information Disclosure' and 'Buffer Overflow', but the CVSS vector sets C:N and the CWE is an out-of-bounds READ (not an overflow write), so those tags overstate the described impact - treat impact as DoS-only unless the vendor states otherwise. Net priority: moderate; patch/upgrade on normal OT maintenance cadence, prioritizing internet-exposed or flat-network devices. |
| Exploit ScenarioDerived | An attacker with network reachability to an OpENer-based EtherNet/IP device sends a malformed CIP SetAttributeList request that drives the server to read beyond allocated bounds, crashing the stack and knocking the industrial device offline. No authentication or user interaction is required, but no public exploit code is referenced, so an attacker would need to craft the request from the open-source parsing logic. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 09, 2026
An out-of-bounds read in the server-side CIP SetAttributeList service of EIPStackGroup OpENer allows an unauthenticated remote attacker to crash or destabilize the CIP/EtherNet/IP stack, producing a denial of service; the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) confirms the impact is availability-only and requires no privileges, user interaction, or non-default configuration. Affected builds are OpENer v2.3 and master through commit 76b95cf. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), so the practical risk hinges on network reachability to embedded industrial controllers, which are typically deployed on segmented OT networks.
RemediationAI
No vendor-released patch has been identified at time of analysis, and the advisory references point to the upstream repository and issue 572 rather than to a tagged fixed release, so verify with the maintainers at https://github.com/EIPStackGroup/OpENer/issues/572 whether a fix commit or release has been published and apply it as soon as one exists. Until then, reduce exposure by blocking external access to EtherNet/IP service ports (TCP/UDP 44818 for explicit messaging, and UDP 2222 for implicit messaging) with OT firewalls or ACLs, which limits the attack surface at the cost of restricting legitimate CIP clients that need cross-zone access. Where the SetAttributeList service is not required, disabling or filtering that CIP service entirely is the most effective compensating control, but it may break engineering-tool workflows that rely on attribute writes. Deploy CIP-aware intrusion detection or deep packet inspection to flag malformed SetAttributeList requests, and keep OpENer-based controllers on segmented OT networks with no direct internet or IT-side reachability, accepting that this does not eliminate the bug but does contain its blast radius. Monitor devices for unexpected restarts or stack faults as an indicator of exploitation attempts.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
OpENer is an open-source implementation of the EtherNet/IP and CIP (Common Industrial Protocol) stack used in embedded industrial devices and test harnesses. The flaw is an out-of-bounds read (CWE-125) in the server-side CIP SetAttributeList service, whose parsing and type-handling code lives in source/src/cip/cipcommon.c, source/src/cip/ciptypes.c, source/src/cip/cipidentity.c and the endianness helpers in source/src/enet_encap/endianconv.c. Because the request payload is decoded with length/index arithmetic that is not adequately bounds-checked before attribute data is read and byte-swapped, a crafted SetAttributeList request causes reads past the end of the allocated buffer, which in an embedded C context typically results in a crash or undefined behavior rather than controlled disclosure. The referenced sources indicate the root cause is missing validation of attacker-controlled length/count fields during CIP service decoding, a classic pattern for memory-safety issues in industrial protocol stacks.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
OpENer's CIP server accepts unauthenticated remote requests (AV:N/AC:L/PR:N/UI:N); the out-of-bounds read yields only a crash, so C:N/I:N/A:H with unchanged scope.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
An out-of-bounds read vulnerability exists in EIPStackGroup OpENer v2.3 and master through commit 76b95cf in the server-side CIP SetAttributeList service. This allows a remote attacker to cause a denial of service
Executive ViewAI
EIPStackGroup OpENer v2.3 and master builds through commit 76b95cf contain a high-severity denial-of-service vulnerability (CVE-2026-75346) that can be triggered remotely without authentication, crashing or destabilizing the CIP/EtherNet/IP stack on affected industrial controllers. Organizations using OpENer in OT environments face potential operational downtime if exposed to untrusted networks, though the availability-only impact and typical network segmentation may limit blast radius. No public exploit identified at time of analysis, but leadership should prioritize identifying exposed assets and implementing interim mitigations while awaiting a vendor patch.
No vendor-released patch identified at time of analysis. Interim mitigations include segmenting OT networks to limit reachability to affected controllers, restricting CIP/EtherNet/IP access to trusted hosts, blocking inbound traffic to the CIP service at network boundaries, monitoring for stack crashes, and applying virtual patching or IDS/IPS signatures if available; apply vendor patch when released.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB