CVE-2026-51537
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk35th percentile - higher than 35% of all known CVEs
Summary
An out-of-bounds read vulnerability was found in EIPStackGroup OpENer version 2.3.0 (commit 76b95cf) in the Connection Manager handling of ForwardOpen requests. The issue occurs when processing short malformed packets, where the parser continues reading fields even when request data is insufficient.
Risk Assessment
An attacker can remotely send a valid ENIP outer frame carrying a malformed CIP ForwardOpen/LargeForwardOpen request without authentication, potentially leading to sensitive data disclosure or system instability.
Recommendation
Immediately update the OpENer library to a patched version or apply a workaround by filtering network traffic to block suspicious ENIP packets.
Original NVD description (English source)
EIPStackGroup OpENer 2.3.0 (commit 76b95cf) has an out-of-bounds read issue in Connection Manager handling of ForwardOpen requests when processing short malformed packets. An attacker can send a valid ENIP outer frame carrying a malformed CIP ForwardOpen/LargeForwardOpen request, causing the parser to continue reading fields even when request data is insufficient. This issue is remotely triggerable via network traffic and does not require authentication.