Executive brief
OpENer is an open-source implementation of the EtherNet/IP industrial protocol used in manufacturing and automation devices. A vulnerability allows a remote attacker to crash or freeze the communication service by sending a single, incomplete network message. This prevents legitimate controllers and workstations from communicating with the device, potentially disrupting industrial operations.
Technical details
A Slowloris-style Denial of Service (DoS) vulnerability exists in the TCP Network Handler of OpENer 2.3.0 (specifically within generic_networkhandler.c). The root cause is the use of a single-threaded event loop combined with blocking socket reads. When a new TCP connection is accepted, the socket is not set to non-blocking mode. An attacker can send a partial EtherNet/IP (ENIP) header specifying a large data size and then withhold the remaining payload. This causes the 'recv' call in 'HandleDataOnTcpSocket' to block indefinitely, stalling the 'NetworkHandlerProcessCyclic' loop and preventing the processing of any other legitimate network traffic. The attack requires only a single unauthenticated TCP connection to port 44818.
Affected products
- EIPStackGroup OpENer 2.3.0 (commit 76b95cf)
Timeline
- 2026-04-23: disclosed: Issue reported on GitHub by MrAlaskan
- 2026-07-03: advisory: Detailed security advisory published via GitHub Gist
- 2026-07-08: disclosed: CVE-2026-51535 published