Executive brief
EIPStackGroup OpENer is an open-source software stack used by industrial devices to communicate over EtherNet/IP networks. A security flaw allows a remote attacker to send a specially crafted network packet that can crash the device or potentially allow unauthorized access to memory. This could lead to a denial-of-service condition, disrupting industrial operations and communication between automated systems.
Technical details
A use-after-free (specifically a stack-use-after-return) vulnerability exists in the SendRRData Handler component of OpENer. The root cause is incorrect lifetime management of the CIP payload pointer across the TCP receive, encapsulation, and Common Packet Format (CPF) parsing layers. Specifically, HandleDataOnTcpSocket receives data into a stack-backed buffer, but the CPF layer stores a raw pointer to this buffer instead of copying the data. When CreateMessageRouterRequestStructure in cipmessagerouter.c later attempts to dereference this pointer after the original function has returned, it triggers a memory corruption event. An attacker can exploit this by sending a crafted EtherNet/IP explicit-message packet over TCP. As of the advisory date, the project has been notified but a formal patch has not been confirmed.
Affected products
- EIPStackGroup OpENer up to 2.3.0
Timeline
- 2026-06-03: advisory: Vulnerability disclosed via VulDB and NVD
- 2026-06-03: other: Public proof-of-concept exploit released