EUVD-2026-95916
GHSA-cmxj-3q64-8hph
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach device EtherNet/IP service port
-
ExploitSend crafted CPF encapsulation packet
-
ExecutionTrigger expired pointer dereference in CPF parser
-
ImpactCrash OpENer stack (denial of service)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The target device must run the OpENer EtherNet/IP stack (v2.3 or master up to commit 76b95cf) and be reachable on its EtherNet/IP encapsulation service (default TCP/UDP 44818, plus UDP 2222 for implicit messaging), which these stacks listen on by default - so no special feature toggle or non-default configuration is required. The flaw is in the CPF parsing path of the encapsulation layer, reachable by any crafted encapsulation message. Per the CVSS vector (PR:N/UI:N), exploitation is unauthenticated with no user interaction. The primary limiting factor is network reachability: OpENer devices are typically deployed on segmented industrial/OT networks, so an attacker needs a foothold on, or routing to, the control network; exploitation yields only a crash (availability loss), not code execution or data access. |
| Impact | Signals are mixed and lean toward lower real-world urgency than the 7.5 CVSS 'High' implies. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a remote, unauthenticated, low-complexity attack, which is a genuinely favorable condition for an attacker; however, the impact is strictly availability (C:N/I:N/A:H) - this is a denial-of-service crash only, with no code execution, data exposure, or integrity loss. No EPSS score, CISA KEV listing, SSVC decision data, or POC exploit code was provided in the input: the only exploitation-relevant reference is an upstream GitHub issue (issue #575), which is a bug report, not weaponized exploit code. Therefore there is no public exploit identified at time of analysis and no confirmed active exploitation. The practical risk is heavily moderated by deployment context: OpENer is an embedded EtherNet/IP stack used in industrial/OT devices, which are typically on segmented networks - but in OT environments an availability crash of a controller or adapter can carry disproportionate operational consequences. Net: treat as a moderate-priority patch for exposed ICS assets, not an emergency; the high CVSS is driven by the easy remote vector, not by breadth of exploitation or impact severity. Missing signal to note explicitly: EPSS and KEV data were not supplied, so widespread-vs-targeted exploitation likelihood cannot be derived from the input. |
| Exploit ScenarioDerived | A remote attacker with network reachability to a device running OpENer sends a crafted EtherNet/IP encapsulation message with a malformed Common Packet Format (CPF) structure to the device's EtherNet/IP service port. Flawed CPF handling dereferences an expired/dangling pointer, crashing the stack and denying service to the industrial device. No authentication or user interaction is required, but no public exploit code was identified - only an upstream bug-tracker report exists. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 09, 2026
Denial of service in EIPStackGroup OpENer 2.3 and master up to commit 76b95cf allows unauthenticated remote attackers to crash the EtherNet/IP stack by sending a crafted Common Packet Format (CPF) message that triggers dereference of an expired pointer in the encapsulation parsing path, yielding availability loss (CVSS 3.1 base 7.5, AV:N/AC:L/PR:N/UI:N/C:N/I:N/A:H). Any device exposing the stack's default encapsulation service (TCP/UDP 44818, plus UDP 2222 for implicit messaging) is reachable without authentication or user interaction, so exploitation requires only network reachability to the control network. No public exploit code was identified at time of analysis and there is no CISA KEV entry, so the practical urgency depends more on whether the device is exposed beyond a segmented OT network than on the raw CVSS 'High' rating; impact is limited to a crash/restart of the stack, not code execution or data disclosure.
RemediationAI
No vendor-released patch was identified at time of analysis - the upstream GitHub issue (https://github.com/EIPStackGroup/OpENer/issues/575) is the tracking point, and integrators should watch it for a fix commit or tagged release rather than assuming a patched build exists; if a fix commit appears, rebuilding and redeploying the stack is required since OpENer is compiled into the product. Until then, the most effective control is network reachability reduction: block TCP/UDP 44818 and UDP 2222 at the OT/IT boundary and permit them only from authorized engineering workstations and CIP clients via host firewall or ACLs, accepting the trade-off that legitimate controllers, HMIs, and asset-management tools outside that allowlist will lose connectivity. Note that simply disabling the encapsulation service is not a viable workaround for EtherNet/IP devices, because encapsulation is the mandatory transport for all CIP traffic - doing so breaks all functionality rather than removing only the vulnerable parser. Additional compensating measures: keep the device on a segmented control network with no direct internet or enterprise-routed exposure (this removes the primary limiting factor an attacker needs), deploy OT-aware deep packet inspection or an IDS signature for malformed/oversized CPF item structures on 44818/2222, and monitor for unexpected stack restarts or process crashes as the observable indicator of an exploitation attempt. Rate-limiting or filtering malformed encapsulation traffic offers only partial protection and can be bypassed by well-formed-looking messages.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
OpENer is an open-source EtherNet/IP (Industrial Ethernet/IP) device stack whose encapsulation layer handles the Common Packet Format, the TLV-style container (item count, address item, data item) used to carry CIP commands inside EtherNet/IP messages. The affected code lives in the encapsulation and CPF handling sources - source/src/enet_encap/cpf.c, source/src/enet_encap/encap.c, and source/src/ports/generic_networkhandler.c - which parse inbound traffic on the default EtherNet/IP encapsulation ports TCP/UDP 44818 and the implicit-messaging UDP port 2222. The flaw is a dereference of an expired (dangling) pointer during CPF processing, a memory-safety class corresponding to CWE-825 (Expired Pointer Dereference) and closely related to use-after-free (CWE-416): a pointer to a buffer or item structure that has already been freed/invalidated is read after the object's lifetime ends, typically crashing the process. Because the vulnerable path is the mandatory message-parsing front door of the stack, no non-default feature, option, or authentication is needed to reach it. The supplied CPE string is a placeholder (n/a:n/a), so exact version-to-build mapping must be taken from the vendor repository and the referenced GitHub issue rather than from CPE data.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Crafted CPF packets are processed pre-authentication over the network (AV:N/PR:N/UI:N) with no special timing (AC:L); impact is a crash only, so C:N/I:N/A:H.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
DescriptionCVE.org
EIPStackGroup OpENer v2.3 and master up to commit 76b95cf contain an expired pointer dereference vulnerability in the EtherNet/IP Common Packet Format (CPF) handling logic. This allows a remote attacker to cause a denial of service.
Executive ViewAI
EIPStackGroup OpENer 2.3 and master up to commit 76b95cf are affected by a high-severity denial-of-service vulnerability that can crash the EtherNet/IP stack and disrupt industrial communications. Affected organizations face availability loss on any device exposing the default encapsulation or implicit messaging services, and exploitation is unauthenticated remote, requiring only network reachability to the control network. Leadership should prioritize action if these devices are reachable outside a well-segmented OT environment, because repeated crashes or restarts could interrupt operations even though there is no code execution or data disclosure risk.
No vendor patch available. Interim mitigations include network segmentation and firewall rules to block or restrict TCP/UDP 44818 and UDP 2222 to trusted OT hosts, disabling unused encapsulation or implicit messaging services where operationally feasible, rate-limiting and monitoring for malformed CPF traffic, and maintaining rapid device/stack restart and backup recovery procedures.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB