Is CVE-2026-51538 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-51538 being exploited in the wild.

How severe is CVE-2026-51538?

Informational severity, with a CVSS score of 0, published 13 July 2026.

Which products and versions are affected?

EIPStackGroup OpENer 2.3.0 (commit 76b95cf).

Is there a fix for CVE-2026-51538?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-51538 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-51538?

Check whether you run EIPStackGroup OpENer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-51538: EIPStackGroup OpENer incorrect access control in encapsulation sessions

CVE-2026-51538 · Severity: info · CVSS 0 · Published 2026-07-13

EIPStackGroup OpENer is an open-source implementation of the EtherNet/IP protocol used in industrial automation to allow devices like controllers and sensors to communicate. A security flaw in how the software manages user sessions allows an attacker to hijack or terminate active connections between legitimate industrial equipment. This could lead to unauthorized control of industrial processes or a complete shutdown of communication between critical devices on the factory floor.

Technologies: EIPStackGroup OpENer. Vendors: EIPStackGroup.

Quick answers

Is CVE-2026-51538 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-51538 being exploited in the wild.
How severe is CVE-2026-51538?: Informational severity, with a CVSS score of 0, published 13 July 2026.
Which products and versions are affected?: EIPStackGroup OpENer 2.3.0 (commit 76b95cf).
Is there a fix for CVE-2026-51538?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-51538 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-51538?: Check whether you run EIPStackGroup OpENer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An improper access control vulnerability (CWE-284) exists in OpENer 2.3.0 (commit 76b95cf) within the encapsulation session handling logic in 'source/src/enet_encap/encap.c'. The 'CheckRegisteredSessions' function verifies if a session handle is active but fails to validate if the handle belongs to the specific TCP socket issuing the request. Because session handles are generated as predictable small integers, a remote, unauthenticated attacker can enumerate active handles and include them in forged encapsulation commands (such as 'SendRRData' or 'UnregisterSession'). This allows the attacker to perform session hijacking or trigger a cross-connection Denial of Service (DoS) by unilaterally terminating legitimate client connections.

Affected products

EIPStackGroup OpENer 2.3.0 (commit 76b95cf)

Timeline

2026-04-23: disclosed: Issue reported on GitHub repository
2026-07-09: advisory: Detailed security advisory published by researcher
2026-07-13: advisory: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.