Junglewise Threat Intelligence

CVE-2026-13592: liftoff-sr CIPster out-of-bounds write in EtherNet/IP Message Handler

CVE-2026-13592 · Severity: high · CVSS 7.3 · Published 2026-06-29

Technologies: Liftoff-Sr CIPster. Vendors: Liftoff Systems.

Executive brief

CIPster is an open-source software library used by industrial devices to communicate over EtherNet/IP networks. A security flaw allows a remote attacker to send specially crafted network messages that can crash the device or potentially allow unauthorized access to its memory. This could lead to service outages in industrial environments or the exposure of sensitive operational data.

Technical details

A vulnerability exists in the BufWriter::append function within the EtherNet/IP Message Handler of CIPster. The root cause is a type-confusion flaw where the library's generic attribute handlers (GetAttrData/SetAttrData) trust a raw storage address without validating that the underlying object layout matches the declared CIP data type. Specifically, if a ByteBuf object is aliased as a writable kCipUdint attribute, an attacker can use a SetAttributeSingle request to overwrite the internal 'start' pointer of the ByteBuf. Subsequent operations on the same buffer as a kCipByteArray will use the poisoned metadata, leading to out-of-bounds reads or writes via memcpy. A patch (3a0159e) has been released that introduces strongly-typed attribute inserters to prevent such aliasing at compile-time.

Affected products

  • liftoff-sr CIPster up to e8e9dba09bf56962807d3504b783ccdb6287f3e4

Timeline

  • 2026-06-01: patched: Patch 3a0159ed43125dcd024a1965f0289cb186bae9ff applied to master branch.
  • 2026-06-29: disclosed: Vulnerability published via VulDB and NVD.

References

Related threats