CVE-2026-75348 Details
Description
An out-of-bounds read vulnerability exists in EIPStackGroup OpENer v2.3 and master up to commit 76b95cf in the EtherNet/IP TCP SendRRData Common Packet Format parser. The issue occurs in CreateCommonPacketFormatStructure() when it parses recognized optional socket address information items of type 0x8000 or 0x8001 without first validating that the remaining CPF buffer contains the complete fixed sockaddr structure. This allows a remote attacker to cause a denial of service.
A vulnerability allowing out-of-bounds read has been identified in EIPStackGroup OpENer versions 2.3 and the master branch prior to commit 76b95cf. The issue arises in the EtherNet/IP TCP SendRRData Common Packet Format (CPF) parser, specifically within the CreateCommonPacketFormatStructure() function. The vulnerability occurs when the parser processes recognized optional socket address information items of type 0x8000 or 0x8001 without first ensuring that the remaining CPF buffer contains the complete fixed sockaddr structure. This oversight enables remote attackers to cause a denial-of-service condition by sending malformed packets.
A suggested fix is to modify the CPF parser to perform length-driven validation of optional socket address items before consuming the fields. This includes checking that the declared length is exactly 16 bytes and rejecting items that do not meet this requirement.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 9, 2026CISA-ADP
Assessed Oct 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/EIPStackGroup/OpENer/issues/573 | CISA-ADP | ExploitIssue TrackingTechnical AnalysisVendor |
| https://github.com/EIPStackGroup/OpENer/blob/master/source/src/enet_encap/cpf.c | [email protected] | Source CodeVendor |
| https://github.com/EIPStackGroup/OpENer/blob/master/source/src/enet_encap/encap.c | [email protected] | Source CodeVendor |
| https://github.com/EIPStackGroup/OpENer/blob/master/source/src/enet_encap/endianconv.c | [email protected] | Source CodeVendor |
| https://github.com/EIPStackGroup/OpENer/issues/573 | [email protected] | ExploitIssue TrackingTechnical AnalysisVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-125 | Out-of-bounds Read | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| EIPStackGroup OpENer | 2.3 master up to commit 76b95cf |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 9, 2026 | CVE Modified | CISA-ADP |
| Oct 9, 2026 | New CVE Received | [email protected] |