Threat Intelligence Database

An out-of-bounds read vulnerability exists in EIPStackGroup OpENer v2.3 and master up to commit 76b95cf in the EtherNet/IP TCP SendRRData Common Packet Format parser. The vulnerability occurs when the parser processes certain optional socket address information items without validating the buffer length, allowing a remote attacker to cause a denial of service.

An out-of-bounds read vulnerability in EIPStackGroup OpENer v2.3 and master through commit 76b95cf affects the server-side CIP SetAttributeList service. This vulnerability allows a remote attacker to cause a denial of service condition. The vulnerability is identified as CVE-2026-75346 and has a high severity rating with a CVSS score of 7.5.

OpENer version 2.3 (commit 76b95cf) contains an out-of-bounds read vulnerability in the server-side EtherNet/IP ForwardOpen connection-path parser. This flaw allows a remote attacker to cause a denial of service condition by triggering the out-of-bounds read.

OpENer version 2.3 (commit 76b95cf) contains an integer underflow vulnerability in the server-side EtherNet/IP ForwardOpen connection-path parser. This flaw allows a remote attacker to cause a denial of service condition on the affected system.

OpENer v2.3/commit 76b95cf, contains an out-of-bounds read in the server-side EtherNet/IP ForwardOpen connection-path parser. This allows a remote attacker to cause a denial of service.

EIPStackGroup OpENer versions before 2.3.0 up to commit 76b95cf contain an out-of-bounds read vulnerability in the Connection Manager request parsing. This vulnerability allows a remote attacker to cause a denial of service. The vulnerability has a CVSS 3.1 score of 7.5, indicating high severity. No known exploits are reported in the wild. No patch or remediation details are provided in the source data.

An out-of-bounds read vulnerability exists in EIPStackGroup OpENer v2.3 and master through commit 76b95cf in the server-side CIP SetAttributeList service. This allows a remote attacker to cause a denial of service

OpENer 2.3.0 (commit 76b95cf) has an out-of-bounds read issue in CIP message parsing when handling malformed explicit requests with a forged EPath size. An attacker can send a valid ENIP SendRRData frame carrying a very short CIP payload whose path_size field claims that many more path words are present than are actually available. Because the parser trusts the attacker-controlled path_size and continues decoding path segments without a remaining-length boundary, it reads beyond the end of the stack receive buffer.

EIPStackGroup OpENer 2.3.0 (commit 76b95cf) suffers from an Incorrect Access Control vulnerability in its handling of encapsulation sessions. When the server processes critical encapsulation commands, it verifies whether the provided session_handle exists in the global session list, but it fails to verify whether that handle belongs to the specific TCP connection issuing the request. Because there is no strong binding between a session handle and its originating socket, any attacker on the network can use a valid session handle created by another legitimate client to bypass access controls.

A security vulnerability has been detected in EIPStackGroup OpENer up to 2.3.0. Affected is the function CreateMessageRouterRequestStructure of the file cipmessagerouter.c of the component SendRRData Handler. The manipulation leads to use after free. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.