CVE-2026-82357

MediumCVSS 6.5

Published: 01/10/2026(UTC)Updated: 07/10/2026(UTC)Translated: 02/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.29%

19th percentile - higher than 19% of all known CVEs

Summary

RT-Labs AB C-Open CANopen contains a NULL pointer dereference if the LSS protocol is used to configure the device. An object defined by the user application may not have all required subindexes for object 0x1018. An unauthenticated, remote attacker with access to the CAN bus, through a compromised node for instance, can initiate the LSS protocol on a device with a misconfigured identity object and potentially crash the device. Fixed in 1.1.1.

Risk Assessment

An attacker can remotely crash the device by initiating the LSS protocol, leading to loss of availability. In industrial environments, this may disrupt system operations.

Recommendation

Update the C-Open CANopen library to version 1.1.1 or later. Ensure identity objects are correctly configured to avoid errors.

Other vulnerabilities in C-Open CANopen

CVE-2026-82358Medium
RT-Labs AB C-Open CANopen contains a write protection bypass in the SDO (Service Data Object) server implementation 'src/co_sdo_server.c' that fails to properly validate write permissions when processing download-segment frames. An unauthenticated attacker on the CAN bus can initiate an SDO upload for a read-only Object Dictionary (OD) entry, which sets a data pointer to the read-only object, then send download-segment frames to write to that memory location. The download-segment handler does not verify that a download session is active, allowing any CANopen node to overwrite read-only OD entries using two SDO frames. Note that CANopen protocol operates over CAN bus and does not provide built-in authentication mechanisms. Fixed in 1.1.1.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS