CVE-2026-75347 in OpENer
Summary
by MITRE • 10/09/2026
EIPStackGroup OpENer v2.3 and master up to commit 76b95cf contain an expired pointer dereference vulnerability in the EtherNet/IP Common Packet Format (CPF) handling logic. This allows a remote attacker to cause a denial of service.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/09/2026
The identified vulnerability resides within EIPStackGroup OpENer, specifically affecting versions 2.3 and code up to commit hash 76b95cf in the master branch. This software implementation serves as an open-source stack for implementing EtherNet/IP protocols, which are critical for industrial automation and control systems communication. The core of the issue lies in the Common Packet Format handling logic, a fundamental component responsible for parsing incoming network packets to extract command data and parameters. When processing these packets, the application fails to properly manage memory lifecycles associated with pointer references during specific operational sequences involving CPF structures.
The technical flaw is classified as an expired pointer dereference, also known in industry standards as CWE-416 Use After Free. This vulnerability occurs when the software attempts to access a memory location that has already been deallocated or freed by another part of the program. In the context of EtherNet/IP packet processing, this typically happens during the parsing phase where temporary buffers are allocated and subsequently released. If an attacker can manipulate the timing or structure of incoming packets such that the application references these pointers after they have become invalid, it results in undefined behavior within the process memory space. This is not a code execution vulnerability by default but rather a stability issue triggered by malformed input data sent over the network.
From an operational perspective, this flaw allows for a remote denial of service attack without requiring authentication or prior interaction with the system. An attacker positioned on the same network segment as the OpENer instance can craft and send specially designed EtherNet/IP packets that trigger the use-after-free condition upon receipt. The immediate consequence is typically a segmentation fault or an application crash, leading to the termination of the service process. In industrial environments where continuous availability is paramount, such crashes disrupt communication with programmable logic controllers, human-machine interfaces, and other connected devices, potentially halting production lines or causing unsafe states in automated processes if fail-safes are not adequately configured.
This vulnerability aligns with MITRE ATT&CK technique T1499 Endpoint Denial of Service, specifically under the sub-technique for resource exhaustion via application crashes. The attack vector is classified as Network-based (T1078) or potentially Local if physical access were involved, but given the remote nature described, it primarily represents a network-level exploitation path against critical infrastructure components. The lack of proper bounds checking and memory state validation in the CPF parser highlights a gap in secure coding practices regarding dynamic memory management during high-throughput packet processing scenarios.
Mitigation strategies should focus on immediate patching to versions that have addressed this specific logic error within the EtherNet/IP stack implementation. Until an official patched release is available, network segmentation is recommended to restrict access to OpENer instances from untrusted networks or hosts. Additionally, implementing strict input validation and fuzz testing during development phases can help identify similar memory management issues early in the software lifecycle. Security teams should monitor for unusual spikes in connection attempts or packet sizes that might indicate probing activity targeting this specific vulnerability vector within industrial control system environments.