CVE-2026-82358

14th percentile - higher than 14% of all known CVEs

RT-Labs AB C-Open CANopen contains a write protection bypass in the SDO (Service Data Object) server implementation 'src/co_sdo_server.c' that fails to properly validate write permissions when processing download-segment frames. An unauthenticated attacker on the CAN bus can initiate an SDO upload for a read-only Object Dictionary (OD) entry, which sets a data pointer to the read-only object, then send download-segment frames to write to that memory location. The download-segment handler does not verify that a download session is active, allowing any CANopen node to overwrite read-only OD entries using two SDO frames. Note that CANopen protocol operates over CAN bus and does not provide built-in authentication mechanisms. Fixed in 1.1.1.

An attacker with access to the CAN bus can overwrite critical read-only entries in the Object Dictionary, potentially leading to unpredictable device behavior, loss of data integrity, or crashes. The lack of authentication in CANopen increases the risk.

Update the C-Open CANopen library to version 1.1.1 or later. Additionally, consider segmenting the CAN network and applying external authentication mechanisms where possible.