Threat database

CVE-2026-82358 is an authorization bypass vulnerability in RT-Labs AB C-Open CANopen protocol stack. The flaw exists in the SDO server implementation where write permissions are not properly validated during download-segment frames processing. This allows an unauthenticated attacker on the CAN bus to overwrite read-only Object Dictionary entries by sending crafted SDO frames. The vulnerability is fixed in version 1.1.1.

CVE-2026-82357 is a NULL pointer dereference vulnerability in RT-Labs AB C-Open CANopen software. It occurs when the LSS protocol is used to configure a device with a misconfigured identity object lacking required subindexes. An unauthenticated remote attacker with CAN bus access can trigger the vulnerability, potentially causing the device to crash. The issue is fixed in version 1.1.1.