CVE-2026-51538
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
An incorrect access control vulnerability was found in OpENer 2.3.0 (commit 76b95cf) during encapsulation session handling. The server only checks if a session handle exists in the global list but does not verify if it belongs to the specific TCP connection making the request. This allows an attacker to hijack another client's session and bypass access controls.
Risk Assessment
An attacker on the network can impersonate an authorized client by hijacking its session and executing critical encapsulation commands without authorization. This could lead to unauthorized access to the controller or industrial device.
Recommendation
Update OpENer to a version that implements strong binding between session handles and TCP sockets immediately. Until then, restrict network access to the server to trusted hosts only.
Other vulnerabilities in OpENer
See all- CVE-2026-51541Critical
An out-of-bounds read vulnerability was found in OpENer 2.3.0 (commit 76b95cf) during CIP message parsing. An attacker can send a valid ENIP SendRRData frame with a very short CIP payload where the path_size field claims more path words than available. Because the parser trusts the attacker-controlled path_size and continues decoding path segments without a remaining-length boundary check, it reads beyond the end of the stack receive buffer.
- CVE-2026-51540Critical
OpENer 2.3.0 (master branch up to commit 76b95cf) is vulnerable to a severe memory corruption issue caused by an integer underflow in the processing of connected explicit messages (SendUnitData).
- CVE-2026-51536Critical
In OpENer 2.3.0 (commit 76b95cf) when parsing CIP packets, the length parameter is inconsistently typed across the call stack. An int length is passed to a function expecting EipInt16, allowing crafted packets to cause overflow or negative values. This bypasses bounds checks and leads to a stack buffer overflow in DecodePaddedEPath.
- CVE-2026-51535High
In OpENer 2.3.0 (commit 76b95cf), a resource exhaustion (Denial of Service) vulnerability exists in its network processing loop. An attacker can send specially crafted packets causing excessive CPU or memory consumption.
- CVE-2026-51221High
A buffer overflow vulnerability in the Get_Attribute_List function of EIPStackGroup OpENer (commit 76b95c) allows an attacker to cause a Denial of Service (DoS) by sending a crafted Common Packet Format (CPF) packet.
- CVE-2026-10703Medium
A use-after-free vulnerability has been detected in EIPStackGroup OpENer up to version 2.3.0 in the function CreateMessageRouterRequestStructure of the file cipmessagerouter.c in the SendRRData Handler component. Remote exploitation is possible and the exploit has been publicly disclosed.
Original NVD description (English source)
EIPStackGroup OpENer 2.3.0 (commit 76b95cf) suffers from an Incorrect Access Control vulnerability in its handling of encapsulation sessions. When the server processes critical encapsulation commands, it verifies whether the provided session_handle exists in the global session list, but it fails to verify whether that handle belongs to the specific TCP connection issuing the request. Because there is no strong binding between a session handle and its originating socket, any attacker on the network can use a valid session handle created by another legitimate client to bypass access controls.