- CVE ID: CVE-2026-51537
- Vendor: EIPStackGroup
- Product: OpENer (Version 2.3.0, commit 76b95cf)
- Vulnerability Type: CWE-125: Out-of-bounds Read
- Attack Type: Remote, Unauthenticated
- Impact: Denial of Service (DoS)
An out-of-bounds read vulnerability exists in the Connection Manager handling of ForwardOpen requests in OpENer 2.3.0. A remotely crafted malformed CIP ForwardOpen request may cause the parser to read beyond the valid request buffer, leading to a Denial of Service condition.
The vulnerability affects the Connection Manager and related message parsing logic, including source/src/cip/cipconnectionmanager.c, source/src/cip/cipconnectionobject.c, and source/src/enet_encap/endianconv.c, specifically the ForwardOpenRoutine, ConnectionObjectInitializeFromMessage, and low-level message read helper functions such as GetByteFromMessage.
An unauthenticated, remote attacker with network access to the target OpENer instance can exploit this vulnerability by connecting to the EtherNet/IP TCP port, typically TCP/44818, and completing session registration.
The attacker can then send a crafted SendRRData packet carrying a malformed ForwardOpen or LargeForwardOpen request. Due to insufficient validation of the remaining request length during parsing, the malformed request may cause the parser to read beyond the valid input buffer.
Successful exploitation can crash the OpENer process and deny service to legitimate industrial communication clients.
- GitHub Issue: EIPStackGroup/OpENer#564