CVE-2026-51541 Details
Description
OpENer 2.3.0 (commit 76b95cf) has an out-of-bounds read issue in CIP message parsing when handling malformed explicit requests with a forged EPath size. An attacker can send a valid ENIP SendRRData frame carrying a very short CIP payload whose path_size field claims that many more path words are present than are actually available. Because the parser trusts the attacker-controlled path_size and continues decoding path segments without a remaining-length boundary, it reads beyond the end of the stack receive buffer.
A vulnerability allowing out-of-bounds read has been identified in EIPStackGroup OpENer version 2.3.0. This issue arises in the CIP message parsing when the application processes malformed explicit requests with a manipulated EPath size. An attacker can exploit this by sending a valid ENIP SendRRData frame that includes a short CIP payload, while the path_size field falsely claims a larger number of path words. The parser, trusting the attacker-controlled path_size, continues to decode path segments without proper length validation, leading to a read beyond the end of the stack receive buffer. This vulnerability is remotely exploitable and does not require authentication, causing a denial-of-service condition by crashing the OpENer process and disrupting legitimate industrial communication.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/EIPStackGroup/OpENer/issues/582 | CISA-ADP | ExploitIssue TrackingVendor Advisory |
| https://gist.github.com/MrAlaskan/705c680856e48c535148265c0899ad4b | [email protected] | Third Party Advisory |
| https://github.com/EIPStackGroup/OpENer/issues/582 | [email protected] | ExploitIssue TrackingVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-125 | Out-of-bounds Read | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| opener project opener | 2.3.0 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 11, 2026 | Initial Analysis | [email protected] |
| Jul 14, 2026 | CVE Modified | CISA-ADP |
| Jul 13, 2026 | New CVE Received | [email protected] |