CVE-2026-75350 in OpENer
Summary
by MITRE • 10/09/2026
EIPStackGroup OpENer v2.3 / master commit 76b95cf contains a buffer overflow in the GetAttributeList() implementation for the EtherNet/IP Get_Attribute_List service. This allows a remote attacker to cause a denial of service
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/09/2026
The vulnerability identified within EIPStackGroup OpENer versions prior to v2.3 and up through master commit 76b95cf represents a critical security flaw located in the implementation of the EtherNet/IP Get_Attribute_List service. This industrial protocol is widely used for communication between automation devices, such as programmable logic controllers and human-machine interfaces, over Ethernet networks. The specific defect resides within the GetAttributeList() function, which is responsible for processing requests from remote clients seeking to retrieve attribute data from an object instance on the target device. When a malicious actor sends a specially crafted request with malformed or excessively long parameters, the application fails to adequately validate the length of the input data before copying it into a fixed-size buffer in memory. This lack of proper boundary checks leads directly to a heap-based buffer overflow condition.
From a technical perspective, this flaw is classified under CWE-120, which denotes Buffer Copy without Checking Size of Input Classic Buffer Overflow. The operational mechanism involves an attacker sending a Get_Attribute_List request where the specified attribute list length exceeds the allocated memory space reserved for processing that specific service call. Because OpENer does not perform rigorous bounds checking on this input prior to execution, the excess data overwrites adjacent memory locations. This corruption of memory can lead to unpredictable behavior within the application process running on the target device. In many embedded industrial control systems, such as those utilizing the OpENer stack, stability is paramount for continuous operation. Consequently, the immediate result of exploiting this vulnerability is typically a crash or segmentation fault of the EtherNet/IP server service, resulting in a denial of service condition where legitimate devices can no longer communicate with the affected asset.
The impact of this vulnerability extends beyond simple availability loss within an isolated network segment. In industrial environments, EtherNet/IP connections are often critical for real-time control and monitoring. A successful exploitation that causes a crash forces administrators to manually restart services or reboot hardware, leading to unplanned downtime in manufacturing processes or utility operations. Furthermore, while the primary reported impact is denial of service, buffer overflows inherently carry the risk of arbitrary code execution if an attacker can precisely control the overwritten memory contents and return addresses. Although current reports emphasize the denial of service aspect due to potential mitigations like Address Space Layout Randomization (ASLR) or stack canaries in some modern builds, older versions or specific configurations may remain fully susceptible to remote code execution attacks via this same vector. This aligns with ATT&CK technique T1498, Network Denial of Service, and potentially T1203, Exploitation for Client Execution if the overflow is leveraged further.
To mitigate this vulnerability, organizations must prioritize patching OpENer to version 2.3 or later, where the GetAttributeList() function has been updated with proper input validation logic. This includes verifying that the requested attribute list length does not exceed predefined limits before initiating memory allocation and copy operations. For environments where immediate patching is not feasible due to operational constraints, network segmentation strategies should be employed to restrict access to EtherNet/IP services exclusively from trusted IP addresses within the control zone. Additionally, deploying intrusion detection systems capable of identifying anomalous EtherNet/IP traffic patterns can provide an additional layer of defense against exploitation attempts. Regular vulnerability assessments and penetration testing focused on industrial protocol implementations are essential to ensure that such memory safety issues do not persist in production environments.