Cipster
Monthly
Memory corruption in liftoff-sr CIPster's generic attribute logic exposes EtherNet/IP-connected devices to remote buffer overrun attacks requiring no authentication. The vulnerability exists in the CipAttribute::SetAttrData decode path, where the prior ByteBuf-based design tracked only a {start, limit} view of byte-array backing buffers without recording physical capacity - allowing a wire-supplied length value to direct writes beyond the allocated memory region. Publicly available exploit code exists (referenced in GitHub issue #47); the vulnerability is not listed in CISA KEV as of the time of analysis.
Out-of-bounds read in CIPster's EtherNet/IP symbolic path parser exposes industrial control systems to remote availability disruption and potential memory disclosure. The flaw resides in `CipAppPath::deserialize_symbolic` (source/src/cip/cipepath.cc), where unsafe `memcpy` calls copy attacker-controlled byte counts from a network-supplied CIP symbolic path segment into a fixed-size stack buffer without bounds enforcement, reachable by a remote unauthenticated attacker sending a crafted EtherNet/IP explicit messaging request. No active exploitation is confirmed (not in CISA KEV), but a POC exploit archive has been publicly released and the CVSS 4.0 E:P modifier corroborates exploit availability.
Memory corruption in liftoff-sr CIPster's generic attribute logic exposes EtherNet/IP-connected devices to remote buffer overrun attacks requiring no authentication. The vulnerability exists in the CipAttribute::SetAttrData decode path, where the prior ByteBuf-based design tracked only a {start, limit} view of byte-array backing buffers without recording physical capacity - allowing a wire-supplied length value to direct writes beyond the allocated memory region. Publicly available exploit code exists (referenced in GitHub issue #47); the vulnerability is not listed in CISA KEV as of the time of analysis.
Out-of-bounds read in CIPster's EtherNet/IP symbolic path parser exposes industrial control systems to remote availability disruption and potential memory disclosure. The flaw resides in `CipAppPath::deserialize_symbolic` (source/src/cip/cipepath.cc), where unsafe `memcpy` calls copy attacker-controlled byte counts from a network-supplied CIP symbolic path segment into a fixed-size stack buffer without bounds enforcement, reachable by a remote unauthenticated attacker sending a crafted EtherNet/IP explicit messaging request. No active exploitation is confirmed (not in CISA KEV), but a POC exploit archive has been publicly released and the CVSS 4.0 E:P modifier corroborates exploit availability.