CVE-2026-51538
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
An incorrect access control vulnerability was found in OpENer 2.3.0 (commit 76b95cf) during encapsulation session handling. The server only checks if a session handle exists in the global list but does not verify if it belongs to the specific TCP connection making the request. This allows an attacker to hijack another client's session and bypass access controls.
Risk Assessment
An attacker on the network can impersonate an authorized client by hijacking its session and executing critical encapsulation commands without authorization. This could lead to unauthorized access to the controller or industrial device.
Recommendation
Update OpENer to a version that implements strong binding between session handles and TCP sockets immediately. Until then, restrict network access to the server to trusted hosts only.
Original NVD description (English source)
EIPStackGroup OpENer 2.3.0 (commit 76b95cf) suffers from an Incorrect Access Control vulnerability in its handling of encapsulation sessions. When the server processes critical encapsulation commands, it verifies whether the provided session_handle exists in the global session list, but it fails to verify whether that handle belongs to the specific TCP connection issuing the request. Because there is no strong binding between a session handle and its originating socket, any attacker on the network can use a valid session handle created by another legitimate client to bypass access controls.