CVE-2026-75349 in OpENer
Summary
by MITRE • 10/09/2026
EIPStackGroup OpENer v2.3.0/master up to commit 76b95cf contains an out-of-bounds read vulnerability in Connection Manager request parsing. This allows a remote attacker to cause a denial of service.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/09/2026
The identified vulnerability resides within the EIPStackGroup component of OpENer, specifically affecting versions from v2.3.0 through commit 76b95cf. As an open-source implementation of EtherNet/IP protocols, OpENer is frequently deployed in industrial control systems and automation environments where reliable communication between programmable logic controllers and other networked devices is critical. The specific flaw occurs during the parsing phase of Connection Manager requests, which are essential for establishing and maintaining session connections within the protocol stack. This architectural role makes the vulnerability particularly significant as it targets a core function responsible for managing device connectivity.
The technical nature of this defect is classified as an out-of-bounds read, corresponding to CWE-125 in the Common Weakness Enumeration standard. During the processing of incoming Connection Manager requests, the software fails to adequately validate buffer boundaries before accessing memory locations based on input data indices. When a remote attacker crafts a malicious request with specific malformed parameters or oversized fields, the parser attempts to access memory addresses that lie outside the allocated buffer space. This improper boundary check allows the application to read arbitrary memory contents rather than triggering an immediate exception or error handling routine designed for invalid inputs.
The operational impact of this vulnerability is primarily centered on service availability and system stability. Because out-of-bounds reads often lead to undefined behavior in C-based systems, the most direct consequence observed is a denial of service condition. The application may crash abruptly when it attempts to interpret garbage data or protected memory regions as valid protocol structures. In an industrial context, such crashes can result in the immediate loss of connectivity for connected devices, halting production lines and potentially causing safety hazards if critical monitoring systems are disconnected unexpectedly. While out-of-bounds reads can sometimes lead to information disclosure by leaking sensitive kernel or application data into attacker-controlled buffers, the primary reported impact here is the disruption of service through system instability.
From a threat modeling perspective aligned with MITRE ATT&CK techniques, this vulnerability facilitates remote exploitation without authentication, fitting within categories related to initial access and resource hijacking via denial of service. Attackers can leverage this flaw by sending specially crafted packets over the network targeting the exposed EtherNet/IP port. The lack of input validation represents a fundamental security design oversight where trust is implicitly placed in incoming protocol messages rather than verifying their structural integrity before processing.
Mitigation strategies should focus on immediate patching and defensive configuration changes. Users operating affected versions must upgrade to a version of OpENer that includes the fix for this parsing logic, ensuring that buffer bounds are strictly enforced during Connection Manager request handling. In environments where upgrading is not immediately feasible, network segmentation plays a crucial role in limiting exposure. Restricting access to EtherNet/IP ports using firewalls or industrial DMZs ensures that only trusted management stations can communicate with the vulnerable devices. Additionally, implementing deep packet inspection solutions capable of detecting anomalous protocol structures can help identify and block malicious requests before they reach the application layer. Regular security audits focusing on input validation practices within embedded network stacks are also recommended to prevent similar vulnerabilities in future development cycles.