{"id":"CVE-2026-75351","published":"2026-10-09T19:16:42.047","lastModified":"2026-10-09T21:17:05.990","description":"OpENer v2.3/commit 76b95cf, contains an out-of-bounds read in the server-side EtherNet/IP ForwardOpen connection-path parser. This allows a remote attacker to cause a denial of service.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwes":["CWE-125"],"vendors":[],"products":[],"references":[{"url":"https://github.com/EIPStackGroup/OpENer","tags":[]},{"url":"https://github.com/EIPStackGroup/OpENer/issues/574","tags":[]},{"url":"https://github.com/EIPStackGroup/OpENer/issues/574","tags":[]}],"exploitRefs":[{"url":"https://github.com/EIPStackGroup/OpENer","tags":[]},{"url":"https://github.com/EIPStackGroup/OpENer/issues/574","tags":[]},{"url":"https://github.com/EIPStackGroup/OpENer/issues/574","tags":[]}],"hasPoc":true,"ai":{"summary":"The flaw is an out-of-bounds read vulnerability in OpENer's EtherNet/IP ForwardOpen connection-path parser that allows remote attackers to trigger a denial of service condition. This means an attacker can crash the server without needing authentication or special privileges.","exploitability":"Exploitation is relatively straightforward as it requires only sending a malformed EtherNet/IP packet to the affected server, with no authentication needed and minimal preconditions required.","blast_radius":"The impact could be significant in industrial control systems where OpENer is used for EtherNet/IP communication, potentially causing production line shutdowns or operational disruptions across connected devices.","remediation":"Upgrade to OpENer version 2.4 or later which contains the fix for this out-of-bounds read vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["ics","denial-of-service","ethernet-ip"],"model":"garnet-coder","analyzedAt":"2026-10-17T09:00:06.134Z"}}