Executive brief
OpENer is an open-source implementation of the EtherNet/IP protocol used in industrial automation and control systems. A vulnerability in how the software handles network messages could allow a remote attacker to crash the service by sending a specially crafted packet. This results in a denial-of-service condition, potentially disrupting industrial operations and communication between devices on the factory floor.
Technical details
A stack-based buffer overflow exists in OpENer 2.3.0 (commit 76b95cf) within the CIP message router and EPATH decoding logic. The vulnerability is caused by inconsistent integer typing where a 32-bit 'int' length is passed to functions expecting a 16-bit signed 'EipInt16', leading to truncation and negative values. These negative values bypass unsigned bounds checks (CWE-194) and result in an underflow when calculating remaining data size. A remote, unauthenticated attacker can trigger this by sending a crafted SendUnitData request over TCP port 44818, leading to a crash in DecodePaddedEPath.
Affected products
- EIPStackGroup OpENer 2.3.0 (commit 76b95cf)
Timeline
- 2026-04-23: disclosed: Issue reported on GitHub by MrAlaskan
- 2026-07-13: advisory: NVD published CVE-2026-51536