- CVE ID: CVE-2026-51536
- Vendor: EIPStackGroup
- Product: OpENer (Version 2.3.0, commit 76b95cf)
- Vulnerability Type: CWE-190: Integer Overflow or Wraparound; CWE-121: Stack-based Buffer Overflow
- Attack Type: Remote
- Impact: Denial of Service (DoS)
An integer overflow and truncation vulnerability exists in the CIP message parsing logic of OpENer 2.3.0. A remotely crafted CIP packet may cause an invalid length value to be propagated during EPATH decoding, resulting in a stack-based buffer overflow and a Denial of Service condition.
The vulnerability affects the CIP message router and EPATH decoding logic, including source/src/cip/cipmessagerouter.c and source/src/cip/cipcommon.c, specifically the NotifyMessageRouter, CreateMessageRouterRequestStructure, and DecodePaddedEPath functions.
A remote attacker with network access to the target OpENer instance can exploit this vulnerability by connecting to the EtherNet/IP TCP port, typically TCP/44818, and establishing a standard CIP communication path, for example through a ForwardOpen request.
The attacker can then send a crafted SendUnitData request containing malicious length and path fields. Due to inconsistent length handling across the CIP message parsing call chain, the crafted packet may cause an invalid length value to be passed into the EPATH decoding logic. This can bypass bounds checks and trigger a stack-based buffer overflow.
Successful exploitation can crash the OpENer process and deny service to legitimate industrial communication clients.
- GitHub Issue: EIPStackGroup/OpENer#563