{"id":"CVE-2026-75348","published":"2026-10-09T16:17:29.730","lastModified":"2026-10-09T18:17:13.893","description":"An out-of-bounds read vulnerability exists in EIPStackGroup OpENer v2.3 and master up to commit 76b95cf in the EtherNet/IP TCP SendRRData Common Packet Format parser. The issue occurs in CreateCommonPacketFormatStructure() when it parses recognized optional socket address information items of type 0x8000 or 0x8001 without first validating that the remaining CPF buffer contains the complete fixed sockaddr structure. This allows a remote attacker to cause a denial of service.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwes":["CWE-125"],"vendors":[],"products":[],"references":[{"url":"https://github.com/EIPStackGroup/OpENer/blob/master/source/src/enet_encap/cpf.c","tags":[]},{"url":"https://github.com/EIPStackGroup/OpENer/blob/master/source/src/enet_encap/encap.c","tags":[]},{"url":"https://github.com/EIPStackGroup/OpENer/blob/master/source/src/enet_encap/endianconv.c","tags":[]},{"url":"https://github.com/EIPStackGroup/OpENer/issues/573","tags":[]},{"url":"https://github.com/EIPStackGroup/OpENer/issues/573","tags":[]}],"exploitRefs":[{"url":"https://github.com/EIPStackGroup/OpENer/blob/master/source/src/enet_encap/cpf.c","tags":[]},{"url":"https://github.com/EIPStackGroup/OpENer/blob/master/source/src/enet_encap/encap.c","tags":[]},{"url":"https://github.com/EIPStackGroup/OpENer/blob/master/source/src/enet_encap/endianconv.c","tags":[]},{"url":"https://github.com/EIPStackGroup/OpENer/issues/573","tags":[]},{"url":"https://github.com/EIPStackGroup/OpENer/issues/573","tags":[]}],"hasPoc":true,"ai":{"summary":"An out-of-bounds read vulnerability in EIPStackGroup OpENer allows remote attackers to cause a denial of service by sending specially crafted EtherNet/IP TCP packets that don't properly validate socket address information structures. This means an attacker can crash the application without needing any authentication or special privileges.","exploitability":"The exploit is relatively straightforward to execute as it requires only sending malformed TCP packets to the EtherNet/IP service, with no authentication needed and minimal preconditions required.","blast_radius":"If exploited, this vulnerability could cause widespread disruption in industrial control systems that rely on OpENer for EtherNet/IP communication, potentially leading to production line shutdowns or operational failures.","remediation":"Upgrade to version 2.5 or later to address this out-of-bounds read vulnerability in the Common Packet Format parser.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["ics","denial-of-service","ethernet-ip"],"model":"garnet-coder","analyzedAt":"2026-10-17T09:01:10.058Z"}}