- CVE ID: CVE-2026-51540
- Vendor: EIPStackGroup
- Product: OpENer (Version 2.3.0, commit 76b95cf)
- Vulnerability Type: CWE-191: Integer Underflow; CWE-125: Out-of-bounds Read
- Attack Type: Remote, Unauthenticated
- Impact: Denial of Service (DoS); Potential Code Execution
A memory corruption vulnerability exists in the handling of connected explicit messages in OpENer 2.3.0. A remotely crafted SendUnitData request may trigger an integer underflow during message length processing, causing invalid length handling and out-of-bounds memory access.
The vulnerability affects connected message parsing and EPATH decoding logic, including source/src/enet_encap/cpf.c, source/src/cip/cipmessagerouter.c, and source/src/cip/cipcommon.c, specifically the NotifyConnectedCommonPacketFormat, CreateMessageRouterRequestStructure, and DecodePaddedEPath functions.
An unauthenticated, remote attacker with network access to the target OpENer instance can exploit this vulnerability by connecting to the EtherNet/IP TCP port, typically TCP/44818, registering a session, and establishing a standard CIP connection.
The attacker can then send a crafted SendUnitData request containing malformed length and path fields. Due to insufficient validation of connected message length values, the crafted request may cause an integer underflow and allow invalid data to reach the EPATH decoding logic.
Successful exploitation can crash the OpENer process, resulting in a Denial of Service condition. Depending on the runtime environment and memory layout, further impact may be possible.
- Project: https://github.com/EIPStackGroup/OpENer
- GitHub Issue: EIPStackGroup/OpENer#568