OpENer EUVD-2026-95903

Requires network reachability to a device running the OpENer EtherNet/IP adapter stack (v2.3.0 / commit 76b95cf) with its CIP services exposed and processing unconnected explicit messages (typically EtherNet/IP encapsulation over TCP/UDP port 44818). EtherNet/IP has no built-in authentication, so per the CVSS vector exploitation is remote and unauthenticated (PR:N) with no user interaction (UI:N) against the default message-router handling. The main limiting factors are exposure of the device's CIP port to the attacker (industrial networks are often segmented/air-gapped) and the fact that impact is confined to availability - a process crash/DoS, not data disclosure or code execution.

Signals are moderately consistent and point to a genuine but bounded availability risk. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) indicates a network-reachable, low-complexity, unauthenticated flaw with no user interaction, whose sole impact is high availability loss - consistent with the description of an out-of-bounds read causing denial of service in the unconnected explicit messaging path. There is no confidentiality or integrity impact (C:N/I:N), so this is a crash/DoS primitive, not code execution, despite the 'Buffer Overflow' tag which overstates the nature of an OOB read. No KEV listing and no EPSS score were provided, so real-world exploitation probability cannot be quantified from the input; absence of EPSS/KEV data is a gap, not evidence of low risk. A GitHub issue (#569) is referenced and likely documents the crash condition, but no explicit public exploit code is confirmed in the input, so this should be treated as a reported memory-safety defect rather than a weaponized threat. Net: a legitimate, easy-to-trigger DoS against exposed OpENer-based industrial devices, but impact is limited to availability and the product's deployment footprint is niche (OT/ICS), so it is a priority primarily for operators of EtherNet/IP devices built on this stack rather than a broad internet-wide emergency.

An attacker with network access to an EtherNet/IP device running OpENer sends a crafted unconnected explicit CIP message to the device's message router. Malformed length or offset fields cause an out-of-bounds read while parsing, crashing the OpENer process and taking the industrial device offline. No authentication or user interaction is required; a public proof-of-concept exploit is not confirmed in the provided data, though GitHub issue #569 appears to document the triggering condition.