CVE-2026-51535

An out-of-bounds read vulnerability was found in OpENer 2.3.0 (commit 76b95cf) during CIP message parsing. An attacker can send a valid ENIP SendRRData frame with a very short CIP payload where the path_size field claims more path words than available. Because the parser trusts the attacker-controlled path_size and continues decoding path segments without a remaining-length boundary check, it reads beyond the end of the stack receive buffer.

OpENer 2.3.0 (master branch up to commit 76b95cf) is vulnerable to a severe memory corruption issue caused by an integer underflow in the processing of connected explicit messages (SendUnitData).

An incorrect access control vulnerability was found in OpENer 2.3.0 (commit 76b95cf) during encapsulation session handling. The server only checks if a session handle exists in the global list but does not verify if it belongs to the specific TCP connection making the request. This allows an attacker to hijack another client's session and bypass access controls.

In OpENer 2.3.0 (commit 76b95cf) when parsing CIP packets, the length parameter is inconsistently typed across the call stack. An int length is passed to a function expecting EipInt16, allowing crafted packets to cause overflow or negative values. This bypasses bounds checks and leads to a stack buffer overflow in DecodePaddedEPath.

A buffer overflow vulnerability in the Get_Attribute_List function of EIPStackGroup OpENer (commit 76b95c) allows an attacker to cause a Denial of Service (DoS) by sending a crafted Common Packet Format (CPF) packet.

A use-after-free vulnerability has been detected in EIPStackGroup OpENer up to version 2.3.0 in the function CreateMessageRouterRequestStructure of the file cipmessagerouter.c in the SendRRData Handler component. Remote exploitation is possible and the exploit has been publicly disclosed.