CVE-2026-51541
criticalpriority · track · 0EPSS 0.006 · 46 %ileEUUSEPSS · scored 2026-10-28
OpENer 2.3.0 (commit 76b95cf) has an out-of-bounds read issue in CIP message parsing when handling malformed explicit requests with a forged EPath size. An attacker can send a valid ENIP SendRRData frame carrying a very short CIP payload whose path_size field claims that many more path words are present than are actually available. Because the parser trusts the attacker-controlled path_size and continues decoding path segments without a remaining-length boundary, it reads beyond the end of the stack receive buffer.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · high–critical · 8.3–9.1
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (2)
Products and version ranges known to be affected.
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (6)
External citations — patches, advisories, analysis.
- https://gist.github.com/MrAlaskan/705c680856e48c535148265c0899ad4bcnnvd
- https://github.com/EIPStackGroup/OpENer/issues/582cnnvd
- https://gist.github.com/MrAlaskan/705c680856e48c535148265c0899ad4benisa_euvd
- https://github.com/EIPStackGroup/OpENer/issues/582enisa_euvd
- https://gist.github.com/MrAlaskan/705c680856e48c535148265c0899ad4bThird Party Advisorynvd
- https://github.com/EIPStackGroup/OpENer/issues/582ExploitIssue TrackingVendor Advisorynvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan