- CVE ID: CVE-2026-51538
- Vendor: EIPStackGroup
- Product: OpENer (Version 2.3.0, commit 76b95cf)
- Vulnerability Type: CWE-284: Improper Access Control
- Attack Type: Remote, Unauthenticated
- Impact: Denial of Service (DoS); Privilege Escalation
An improper access control vulnerability exists in the encapsulation session handling logic of OpENer 2.3.0. A remote attacker may reuse a valid session handle associated with another client connection to issue encapsulation commands, potentially resulting in unauthorized command processing and a Denial of Service condition.
The vulnerability affects the encapsulation session handling logic in source/src/enet_encap/encap.c, specifically the CheckRegisteredSessions function and command handling paths for UnregisterSession, SendRRData, and SendUnitData.
An unauthenticated, remote attacker with network access to the target OpENer instance can exploit this vulnerability by connecting to the EtherNet/IP TCP port, typically TCP/44818.
The attacker can then provide a valid session handle that was created by another legitimate client. Due to insufficient binding between encapsulation session handles and their originating TCP connections, the server may accept and process encapsulation commands submitted from the attacker-controlled connection.
Successful exploitation may allow unauthorized use of another client's session handle and can disrupt legitimate industrial communication, resulting in a Denial of Service condition.
- GitHub Issue: EIPStackGroup/OpENer#565
Huashuo Liu, Qixun Tang, Jinwen Xi, and Min Liu from Institute of Computing Technology, Chinese Academy of Sciences