RT-Labs AB C-Open CANopen contains a write protection bypass vulnerability in the SDO server implementation (src/co_sdo_server.c). The flaw allows an unauthenticated attacker on the CAN bus to initiate an SDO upload for a read-only Object Dictionary entry, setting a data pointer to the read-only object. The attacker can then send download-segment frames to write to that memory location because the download-segment handler does not verify that a download session is active. This enables any CANopen node to overwrite read-only OD entries using just two SDO frames. The CANopen protocol itself lacks built-in authentication, which contributes to the risk. The vulnerability is fixed in version 1.1.1.

An unauthenticated attacker on the CAN bus can bypass write protections and modify read-only Object Dictionary entries in affected RT-Labs AB C-Open CANopen devices. This leads to unauthorized integrity violations (data modification) without impacting confidentiality or availability. The vulnerability does not require privileges or user interaction and can be exploited remotely over the CAN bus.

A fix is available in RT-Labs AB C-Open version 1.1.1. Users and administrators should upgrade to version 1.1.1 or later to remediate this vulnerability. No additional vendor mitigation guidance is provided. Since the vulnerability is fixed, no urgent workarounds are necessary.