CVE-2026-51541
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk31th percentile - higher than 31% of all known CVEs
Summary
An out-of-bounds read vulnerability was found in OpENer 2.3.0 (commit 76b95cf) during CIP message parsing. An attacker can send a valid ENIP SendRRData frame with a very short CIP payload where the path_size field claims more path words than available. Because the parser trusts the attacker-controlled path_size and continues decoding path segments without a remaining-length boundary check, it reads beyond the end of the stack receive buffer.
Risk Assessment
The organization risks leakage of sensitive stack memory data or potential system instability via a crafted network request. The attack requires no authentication and can be performed remotely.
Recommendation
Immediately update the OpENer library to a patched version or apply temporary firewall rules to block unauthorized ENIP/CIP packets.
Other vulnerabilities in OpENer
See all- CVE-2026-51540Critical
OpENer 2.3.0 (master branch up to commit 76b95cf) is vulnerable to a severe memory corruption issue caused by an integer underflow in the processing of connected explicit messages (SendUnitData).
- CVE-2026-51538Critical
An incorrect access control vulnerability was found in OpENer 2.3.0 (commit 76b95cf) during encapsulation session handling. The server only checks if a session handle exists in the global list but does not verify if it belongs to the specific TCP connection making the request. This allows an attacker to hijack another client's session and bypass access controls.
- CVE-2026-51536Critical
In OpENer 2.3.0 (commit 76b95cf) when parsing CIP packets, the length parameter is inconsistently typed across the call stack. An int length is passed to a function expecting EipInt16, allowing crafted packets to cause overflow or negative values. This bypasses bounds checks and leads to a stack buffer overflow in DecodePaddedEPath.
- CVE-2026-51535High
In OpENer 2.3.0 (commit 76b95cf), a resource exhaustion (Denial of Service) vulnerability exists in its network processing loop. An attacker can send specially crafted packets causing excessive CPU or memory consumption.
- CVE-2026-51221High
A buffer overflow vulnerability in the Get_Attribute_List function of EIPStackGroup OpENer (commit 76b95c) allows an attacker to cause a Denial of Service (DoS) by sending a crafted Common Packet Format (CPF) packet.
- CVE-2026-10703Medium
A use-after-free vulnerability has been detected in EIPStackGroup OpENer up to version 2.3.0 in the function CreateMessageRouterRequestStructure of the file cipmessagerouter.c in the SendRRData Handler component. Remote exploitation is possible and the exploit has been publicly disclosed.
Original NVD description (English source)
OpENer 2.3.0 (commit 76b95cf) has an out-of-bounds read issue in CIP message parsing when handling malformed explicit requests with a forged EPath size. An attacker can send a valid ENIP SendRRData frame carrying a very short CIP payload whose path_size field claims that many more path words are present than are actually available. Because the parser trusts the attacker-controlled path_size and continues decoding path segments without a remaining-length boundary, it reads beyond the end of the stack receive buffer.