CVE-2026-75346 in OpENer
Summary
by MITRE • 10/09/2026
An out-of-bounds read vulnerability exists in EIPStackGroup OpENer v2.3 and master through commit 76b95cf in the server-side CIP SetAttributeList service. This allows a remote attacker to cause a denial of service
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/09/2026
The identified security flaw resides within the OpenEtherNet/IP implementation known as EIPStackGroup OpENer, specifically affecting versions up through v2.3 and code commits prior to 76b95cf. The vulnerability is located in the server-side handling of the Common Industrial Protocol SetAttributeList service. This protocol component is critical for industrial automation systems that rely on EtherNet/IP communication standards to exchange configuration data and control signals between devices such as programmable logic controllers, sensors, and human-machine interfaces. The specific technical failure involves an out-of-bounds read operation triggered during the processing of attribute list requests sent by a client device. When the server receives a malformed or excessively long SetAttributeList request, it fails to adequately validate the length of the incoming data against the allocated buffer size before attempting to access memory locations beyond the intended boundaries.
This lack of proper boundary checking allows an attacker who can communicate with the affected service over the network to trigger arbitrary read operations in the server's memory space. While out-of-bounds reads are often associated with information disclosure, in this specific context within a resource-constrained industrial environment or under certain execution conditions, the primary observable consequence is system instability leading to denial of service. The improper memory access can cause the application thread handling the connection to crash, terminate unexpectedly, or enter an unrecoverable error state. This effectively disrupts the availability of the EtherNet/IP server, preventing legitimate devices from establishing connections, retrieving status information, or sending control commands. In industrial settings where continuous operation is paramount, such a disruption can halt production lines and create significant operational downtime.
From a classification perspective, this vulnerability aligns with CWE-125, which describes Out-of-bounds Read vulnerabilities resulting from insufficient validation of input data lengths against buffer capacities. The attack vector leverages the network accessibility of the EtherNet/IP service, typically operating on UDP port 44818 or TCP port 2222 depending on configuration and specific implementation details. This aligns with MITRE ATT&CK technique T1499, Endpoint Denial of Service, where an adversary exploits a software flaw to degrade or destroy the availability of critical infrastructure components. The attacker does not necessarily need authentication if the service is exposed to untrusted networks, making this a remote exploit scenario that poses a severe risk to operational technology environments lacking proper network segmentation.
Mitigation strategies must focus on both immediate remediation and long-term architectural improvements. The most effective solution is to apply vendor-provided patches or update EIPStackGroup OpENer to version 2.3 with commit 76b95cf or later, which includes the necessary bounds checking logic in the SetAttributeList service handler. If patching is not immediately feasible, network-level controls should be implemented to restrict access to EtherNet/IP ports exclusively to trusted IP addresses within the industrial control system zone. Deploying deep packet inspection firewalls capable of validating CIP protocol structures can help filter out malformed requests before they reach the vulnerable application layer. Additionally, implementing strict input validation at the application level for all incoming attribute lists is essential to prevent similar flaws in future updates or related services. Regular vulnerability assessments and penetration testing focused on industrial protocols are recommended to identify other potential weaknesses in the OT environment.