Executive brief
CIPster is an EtherNet/IP protocol stack used in industrial I/O adapter devices. A vulnerability in the ForwardOpen connection handler allows remote attackers to craft malicious network messages that trigger an out-of-bounds memory read, potentially leading to information disclosure or denial of service in industrial control systems relying on this stack.
Technical details
The vulnerability is an out-of-bounds read in the CipConnMgrClass::forward_open function within cipconnectionmanager.cc. The flaw is triggered by manipulation of the product_code_ argument, allowing an attacker to read memory outside intended buffer boundaries. The attack is network-accessible and requires no authentication or user interaction. An attacker can exploit this remotely to leak sensitive information from the affected device's memory or cause denial of service. A patch has been identified (commit ea870a274bf68dfaa3f511f20e2fff6778fb7b74) and should be applied to remediate the issue.
Affected products
- liftoff-sr CIPster up to commit 80040d1 (before ea870a274bf68dfaa3f511f20e2fff6778fb7b74)
Timeline
- 2026-08-20: disclosed: CVE-2026-76988 published on NVD