EUVD-2026-95902
GHSA-6957-qm46-gxv7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach device on EtherNet/IP port
-
DeliveryCraft malformed Connection Manager request
-
ExploitTrigger out-of-bounds read in CIP parser
-
ExecutionCrash or hang OpENer stack
-
ImpactDeny service to industrial device
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The target device must run the EIPStackGroup OpENer stack (v2.3.0/master up to commit 76b95cf) and expose its EtherNet/IP service on the network (typically TCP/UDP 44818 and UDP 2222), with the CIP Connection Manager object reachable to process incoming Connection Manager requests - which is the stack's default operating mode. No authentication, no special non-default configuration, and no user interaction are required (PR:N/UI:N), so any attacker who can send packets to the device's EtherNet/IP port can trigger it. The principal limiting factors are network reachability (these are usually segmented OT/ICS networks rather than internet-exposed hosts) and the impact ceiling: the flaw causes only denial of service, not code execution or data exposure. |
| Impact | The input CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5 HIGH) is internally consistent with the description: a remote, unauthenticated, low-complexity out-of-bounds read in OpENer's CIP Connection Manager request parsing that yields availability-only impact (C:N/I:N) - i.e. a pure denial of service, not code execution or data disclosure. No EPSS score, SSVC decision, or CISA KEV entry was provided, and there is no indication of a public proof-of-concept; GitHub issue #577 is referenced as the likely bug report but no exploit artifact is cited. This is therefore a HIGH-CVSS score driven almost entirely by the network/unauthenticated reachability of an industrial protocol stack, while the actual payoff to an attacker is limited to crashing or hanging the affected device rather than compromising it. Real-world priority is moderated by low estimated deployment footprint (OpENer is a niche open-source EtherNet/IP stack, not a ubiquitous product) and by the DoS-only impact; however, in OT/ICS contexts a device crash can be operationally significant. CWE is listed as N/A and the CPE is a placeholder (cpe:2.3:a:n/a:n/a:*), so affected-version precision is weak - treat the 'up to commit 76b95cf' boundary as the authoritative scope. Net: a credible but not urgent issue absent evidence of exploitation. |
| Exploit ScenarioDerived | An attacker with network reachability to a device running the OpENer EtherNet/IP stack sends a crafted Connection Manager (e.g. Forward Open) request whose length/field values drive the parser to read past the bounds of the request buffer. The malformed read triggers a crash or abnormal termination of the stack, denying service to the industrial device. No public exploit code is identified at time of analysis, and no authentication or user interaction is required. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 09, 2026
Remote, unauthenticated attackers can crash devices running the EIPStackGroup OpENer EtherNet/IP stack (v2.3.0 and master up to commit 76b95cf) by sending a crafted Connection Manager request that triggers an out-of-bounds read during parsing. The flaw requires only network reachability to the stack's EtherNet/IP service on its default operating mode - no credentials, no special configuration, and no user interaction - and yields availability-only impact (CVSS 7.5, C:N/I:N/A:H), meaning denial of service rather than code execution or data disclosure. No public exploit identified at time of analysis, and the issue is tracked upstream as GitHub issue #577; exploitability is mainly bounded by the fact that affected devices typically sit on segmented OT/ICS networks rather than being internet-exposed.
RemediationAI
No vendor-released patch identified at time of analysis; the upstream fix is being tracked in GitHub issue #577 (https://github.com/EIPStackGroup/OpENer/issues/577), so integrators should monitor that issue and the repository (https://github.com/EIPStackGroup/OpENer) for an upstream fix and rebuild/reflash their firmware once a corrected commit or release is published - note that until then, any newly built firmware must be validated as actually containing the bounds check, since a fix commit alone is not an independently confirmed patched release. Because the flaw is in the stack's default receive path, there is no configuration switch that cleanly disables it without also disabling legitimate Connection Manager functionality, so the practical mitigation is network-level: restrict access to the EtherNet/IP service so that only trusted engineering workstations and controllers can reach TCP/UDP 44818 and UDP 2222, enforced with OT firewall/ACL rules or a purpose-built EtherNet/IP-aware deep packet inspection device; the trade-off is that overly broad blocking breaks class-1 implicit I/O and explicit messaging, so rules must be scoped to the specific peer addresses that legitimately originate CIP connections. Where the affected device is a software or simulation endpoint, stopping or isolating the service removes the exposure entirely at the cost of losing its EtherNet/IP role, and where possible place affected devices in a segmented OT zone with no inbound path to IT/Internet, accepting that this does not protect against a compromised host already inside the zone. As supplementary detection, log or alert on malformed CIP Connection Manager requests and on unexpected restarts of EtherNet/IP endpoints, since a crash-and-recover pattern on the stack is the observable symptom of successful exploitation.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
OpENer is an open-source implementation of the EtherNet/IP protocol, which layers the Common Industrial Protocol (CIP) over TCP/UDP - conventionally TCP/UDP 44818 for explicit messaging and UDP 2222 for implicit (I/O) messaging. A Connection Manager request arrives through the encapsulation layer (source/src/enet_encap/encap.c) and the Common Packet Format handling (source/src/enet_encap/cpf.c), is dispatched by the CIP message router (source/src/cip/cipmessagerouter.c), and is then parsed by the Connection Manager object in source/src/cip/cipconnectionmanager.c. The vulnerability is a memory-safety defect in that request-parsing path: malformed input causes the code to read past the end of an allocated buffer. The reference feeds assign no CWE identifier, but the defect class is an out-of-bounds read (the CWE-125 family), and the supplied tags ('Buffer Overflow', 'Denial Of Service') align with that classification. An out-of-bounds read of this kind typically aborts or faults the parsing process - here the whole embedded stack - and, consistent with the assessed vector (C:N/I:N/A:H), does not by itself provide code execution, memory corruption primitives, or data exfiltration. The affected code is on the default receive path, so the Connection Manager object is reachable on any device that has the stack running and its EtherNet/IP port exposed.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Remote unauthenticated parsing of network-delivered Connection Manager requests gives AV:N/AC:L/PR:N/UI:N; an out-of-bounds read causing a crash is availability-only, so C:N/I:N/A:H.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
DescriptionCVE.org
EIPStackGroup OpENer v2.3.0/master up to commit 76b95cf contains an out-of-bounds read vulnerability in Connection Manager request parsing. This allows a remote attacker to cause a denial of service.
Executive ViewAI
A denial-of-service flaw in the EIPStackGroup OpENer EtherNet/IP stack, used in industrial and OT-connected devices, allows anyone with network reachability to the EtherNet/IP service to crash affected devices by sending a single malformed Connection Manager request. Because these devices frequently underpin industrial control processes, an outage could disrupt production, safety monitoring, or physical operations even though no data theft or code execution is possible. With no vendor patch currently available and embedded OT gear typically too costly or disruptive to replace quickly, leadership should treat this as an operational resilience and segmentation issue rather than a data-breach issue.
No vendor-released patch identified at time of analysis. Interim mitigations: isolate affected devices behind OT network segmentation and strict firewall/ACL rules that limit access to the EtherNet/IP service to trusted hosts only; block or filter inbound traffic on the EtherNet/IP ports at network boundaries; deploy OT-aware intrusion detection/prevention signatures for malformed Connection Manager requests; monitor device availability for unexpected restarts; track and adopt the upstream fix referenced in GitHub issue #577 as soon as it is released.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB