Executive brief
NetStaX is an EtherNet/IP protocol stack used by industrial devices to communicate on modern factory networks. A flaw in versions prior to 5.6.1 allows an attacker on the same network segment to send a specially crafted Class 3 explicit message that silently overflows the device's message buffer, potentially corrupting memory, crashing the device, or executing arbitrary code. The originating device receives no error notification, making the attack difficult to detect.
Technical details
This is a buffer overflow vulnerability in the EtherNet/IP stack's explicit messaging handler. The root cause is a mismatch between the network layer's maximum payload size (MAX_DATA_FIELD_SIZE) and the application layer's receive buffer size (MAX_REQUEST_DATA_SIZE) in different header files with no enforced relationship. The vulnerable function routerParseObjectRequest() copies admitted data into requestData[] without bounds checking. A remote attacker on the same network segment can send a Class 3 explicit message with a payload larger than the application buffer but within the network layer's admission window, causing an unbounded stack/heap buffer write. NetStaX v5.6.1 fixes this with compile-time assertions, runtime payload-size validation, and clearer documentation of buffer-size relationships. No authentication or user interaction is required; the attack is network-reachable.
Affected products
- Pyramid Solutions NetStaX EtherNet/IP Stack prior to 5.6.1
Timeline
- 2026-09-01: disclosed: CVE-2026-78012 published on NVD
- 2026-08-18: patched: NetStaX v5.6.1 released addressing the vulnerability
- 2026-08-21: other: Vulnerability reported for CVE assignment