Executive brief
EIPStackGroup OpENer is an open-source implementation of the EtherNet/IP industrial protocol used to facilitate communication between industrial devices. A security vulnerability has been identified where a remote attacker can send a specially crafted network packet to crash the software. This results in a denial-of-service condition, potentially disrupting industrial operations and communication between connected equipment.
Technical details
An out-of-bounds read vulnerability exists in EIPStackGroup OpENer 2.3.0 (commit 76b95cf) within the Connection Manager's handling of ForwardOpen and LargeForwardOpen requests. The root cause is a 'parse-before-validate' logic error combined with missing boundary checks in low-level read helpers (e.g., GetByteFromMessage) located in cipconnectionmanager.c and cipconnectionobject.c. An unauthenticated remote attacker can establish a TCP connection to port 44818, register a session, and send a SendRRData packet with a malformed CIP request. If the request data is shorter than expected, the parser continues reading fields past the end of the stack-based receive buffer, leading to an AddressSanitizer-detected stack-buffer-overflow and process termination (Denial of Service).
Affected products
- EIPStackGroup OpENer 2.3.0 (commit 76b95cf)
Timeline
- 2026-04-23: disclosed: Issue reported on GitHub by MrAlaskan
- 2026-07-09: advisory: Detailed security advisory published by researcher
- 2026-07-13: advisory: CVE-2026-51537 published in NVD