CVE-2026-51536 Details
Description
In OpENer 2.3.0 (commit 76b95cf) when parsing incoming CIP (Common Industrial Protocol) network packets, the length parameter is inconsistently typed across the call stack. Specifically, an upstream length calculated as an int is passed to a downstream function that expects an EipInt16 (a 16-bit signed integer). If a maliciously crafted packet with specific length fields is processed, the length parameter can overflow or be truncated into a negative value. This negative length bypasses subsequent bounds checking (due to signed/unsigned comparison issues) and is ultimately used in memory operations, leading to a Stack Buffer Overflow when reading data in DecodePaddedEPath.
A vulnerability in EIPStackGroup OpENer version 2.3.0 (commit 76b95cf) allows for a stack-based buffer overflow due to improper handling of length parameters in CIP (Common Industrial Protocol) message parsing. The issue arises when an integer overflow or truncation occurs, converting a length value into a negative integer. This negative value bypasses standard bounds checks and is exploited during EPATH decoding, leading to memory corruption. The vulnerability can be triggered remotely by sending crafted CIP packets through the EtherNet/IP TCP port (typically TCP/44818).
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/EIPStackGroup/OpENer/issues/563 | CISA-ADP | ExploitIssue TrackingVendor Advisory |
| https://gist.github.com/MrAlaskan/e160c626a32e03e5d9eddaa732560672 | [email protected] | Third Party Advisory |
| https://github.com/EIPStackGroup/OpENer/issues/563 | [email protected] | ExploitIssue TrackingVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-190 | Integer Overflow or Wraparound | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| opener project opener | 2.3.0 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 11, 2026 | Initial Analysis | [email protected] |
| Jul 14, 2026 | CVE Modified | CISA-ADP |
| Jul 13, 2026 | New CVE Received | [email protected] |