CVE-2026-51541
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
An out-of-bounds read vulnerability was found in OpENer 2.3.0 (commit 76b95cf) during CIP message parsing. An attacker can send a valid ENIP SendRRData frame with a very short CIP payload where the path_size field claims more path words than available. Because the parser trusts the attacker-controlled path_size and continues decoding path segments without a remaining-length boundary check, it reads beyond the end of the stack receive buffer.
Risk Assessment
The organization risks leakage of sensitive stack memory data or potential system instability via a crafted network request. The attack requires no authentication and can be performed remotely.
Recommendation
Immediately update the OpENer library to a patched version or apply temporary firewall rules to block unauthorized ENIP/CIP packets.
Original NVD description (English source)
OpENer 2.3.0 (commit 76b95cf) has an out-of-bounds read issue in CIP message parsing when handling malformed explicit requests with a forged EPath size. An attacker can send a valid ENIP SendRRData frame carrying a very short CIP payload whose path_size field claims that many more path words are present than are actually available. Because the parser trusts the attacker-controlled path_size and continues decoding path segments without a remaining-length boundary, it reads beyond the end of the stack receive buffer.