Executive brief
OpENer is an open-source implementation of the EtherNet/IP industrial protocol used to facilitate communication between industrial devices. A vulnerability in how the software processes incoming messages allows a remote, unauthenticated attacker to send a specially crafted request that causes the application to crash. This results in a denial-of-service condition, potentially disrupting industrial operations and communication between networked hardware.
Technical details
An out-of-bounds read vulnerability exists in OpENer 2.3.0 (commit 76b95cf) within the CIP explicit message parsing logic. The issue resides in the `DecodePaddedEPath` function in `cipcommon.c` and `CreateMessageRouterRequestStructure` in `cipmessagerouter.c`. The parser trusts an attacker-controlled `path_size` field in a malformed ENIP SendRRData frame without verifying the actual remaining length of the input buffer. An unauthenticated remote attacker can provide a forged EPath size that exceeds the available data, causing the decoder to read beyond the 512-byte stack receive buffer. This leads to a stack-buffer-overflow (as detected by AddressSanitizer) and an immediate process crash (Denial of Service).
Affected products
- EIPStackGroup OpENer 2.3.0 (commit 76b95cf)
Timeline
- 2026-06-05: disclosed: Issue reported on GitHub by MrAlaskan
- 2026-07-09: advisory: Security advisory published by MrAlaskan
- 2026-07-13: advisory: CVE published to NVD dataset