C Open
Monthly
A write-protection bypass in the CANopen SDO server of RT-Labs AB C-Open (all versions before 1.1.1) allows any device on the same CAN bus to overwrite read-only Object Dictionary entries, corrupting protected configuration and process data on affected nodes. No authentication is required - the CANopen protocol has no built-in authentication (CVSS vector PR:N) - but the attacker must be able to send SDO frames to the target node's SDO server, meaning they need a presence on the same CAN segment; this adjacent-access requirement (AV:A) is the primary limiting factor. Impact is integrity-only (C:N/I:H/A:N): an attacker can point the data pointer at a read-only OD entry via an SDO upload for that entry, then send download-segment frames that the handler processes without verifying that a download session is active, overwriting the protected object in as few as two SDO frames. There is no confirmed active exploitation (not listed in CISA KEV) and no public exploit code identified at time of analysis.
NULL pointer dereference in RT-Labs AB C-Open (CANopen protocol stack, all versions before 1.1.1) lets an unauthenticated attacker who already has access to the CAN bus crash an affected device by starting the LSS (Layer Setting Services) protocol against a node whose user application defined identity object 0x1018 without all of its required subindexes. Impact is availability-only (CVSS 4.0 base 7.1; independently assessed as CVSS 3.1 AV:A/AC:L/PR:N/UI:N/A:H), meaning a device reset/denial of service rather than data disclosure or code execution, and exploitation is bounded by three prerequisites: bus-local (adjacent) access - reachable, for example, through a compromised node, not from the internet - a misconfigured, non-default identity object, and the ability to send LSS frames. No public exploit code was identified at time of analysis, and the issue is not confirmed as actively exploited (not in CISA KEV). Fixed in C-Open 1.1.1, the same release that also addresses CVE-2026-82358.
A write-protection bypass in the CANopen SDO server of RT-Labs AB C-Open (all versions before 1.1.1) allows any device on the same CAN bus to overwrite read-only Object Dictionary entries, corrupting protected configuration and process data on affected nodes. No authentication is required - the CANopen protocol has no built-in authentication (CVSS vector PR:N) - but the attacker must be able to send SDO frames to the target node's SDO server, meaning they need a presence on the same CAN segment; this adjacent-access requirement (AV:A) is the primary limiting factor. Impact is integrity-only (C:N/I:H/A:N): an attacker can point the data pointer at a read-only OD entry via an SDO upload for that entry, then send download-segment frames that the handler processes without verifying that a download session is active, overwriting the protected object in as few as two SDO frames. There is no confirmed active exploitation (not listed in CISA KEV) and no public exploit code identified at time of analysis.
NULL pointer dereference in RT-Labs AB C-Open (CANopen protocol stack, all versions before 1.1.1) lets an unauthenticated attacker who already has access to the CAN bus crash an affected device by starting the LSS (Layer Setting Services) protocol against a node whose user application defined identity object 0x1018 without all of its required subindexes. Impact is availability-only (CVSS 4.0 base 7.1; independently assessed as CVSS 3.1 AV:A/AC:L/PR:N/UI:N/A:H), meaning a device reset/denial of service rather than data disclosure or code execution, and exploitation is bounded by three prerequisites: bus-local (adjacent) access - reachable, for example, through a compromised node, not from the internet - a misconfigured, non-default identity object, and the ability to send LSS frames. No public exploit code was identified at time of analysis, and the issue is not confirmed as actively exploited (not in CISA KEV). Fixed in C-Open 1.1.1, the same release that also addresses CVE-2026-82358.