CVE-2026-82358 in C-Open
Summary
by MITRE • 10/01/2026
RT-Labs AB C-Open CANopen contains a write protection bypass in the SDO (Service Data Object) server implementation 'src/co_sdo_server.c' that fails to properly validate write permissions when processing download-segment frames. An unauthenticated attacker on the CAN bus can initiate an SDO upload for a read-only Object Dictionary (OD) entry, which sets a data pointer to the read-only object, then send download-segment frames to write to that memory location. The download-segment handler does not verify that a download session is active, allowing any CANopen node to overwrite read-only OD entries using two SDO frames. Note that CANopen protocol operates over CAN bus and does not provide built-in authentication mechanisms. Fixed in 1.1.1.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/01/2026
The vulnerability identified in RT-Labs AB C-Open CANopen represents a critical failure in access control enforcement within the Service Data Object server implementation, specifically located in the source file src/co_sdo_server.c. This flaw stems from an insufficient validation of write permissions when processing download-segment frames during SDO transactions. In standard CANopen architecture, the Object Dictionary serves as the central repository for configuration parameters and process data, with entries designated as either read-only or read-write to enforce operational integrity. The vulnerability allows an unauthenticated attacker operating on the same Controller Area Network bus to bypass these restrictions by exploiting a logic error in how download sessions are managed. Because CANopen is designed primarily for industrial automation environments where physical security of the network segment was historically assumed, it lacks built-in authentication mechanisms, making such logical flaws particularly dangerous as they can be exploited remotely without prior credential acquisition.
The technical mechanism of this exploit involves a two-step process that abuses the SDO protocol's state machine and memory handling logic. First, an attacker initiates an SDO upload request targeting a read-only Object Dictionary entry. This action successfully sets an internal data pointer within the server to reference the target read-only object in memory. Normally, subsequent write operations would be blocked by permission checks; however, the vulnerability lies in the handler for download-segment frames. The implementation fails to verify whether a legitimate, authorized download session is currently active before allowing data to be written through that pointer. Consequently, an attacker can immediately follow up with one or more download-segment frames containing malicious payload data. Since the server does not validate the authorization context of these segments against the initial upload request's permissions, it proceeds to overwrite the memory location associated with the read-only entry. This effectively allows any node on the CAN bus to modify critical configuration parameters using just two SDO frames, circumventing the intended immutability of those settings.
The operational impact of this vulnerability is severe and potentially catastrophic in industrial control systems where CANopen is prevalent. By overwriting read-only Object Dictionary entries, an attacker can alter fundamental device configurations such as baud rates, node IDs, or safety-related parameters. This manipulation can lead to denial of service by disrupting network communication, cause data integrity issues by corrupting process values, or enable further attacks by changing security settings that were intended to be static and protected. In critical infrastructure scenarios, this could result in physical damage to machinery, unsafe operating conditions, or complete system compromise if these parameters control safety interlocks or emergency stop functions. The lack of authentication exacerbates the risk, as any device connected to the bus can perform this attack without detection by standard network security tools that do not inspect CANopen application layer semantics.
From a classification perspective, this vulnerability aligns with CWE-284 Improper Access Control and CWE-732 Incorrect Permission Assignment for Critical Resource, reflecting the failure to enforce restrictive access rights on sensitive data objects. It also maps to MITRE ATT&CK techniques related to Defense Evasion via permission modification or Impact via system configuration change, depending on the specific entry targeted. The absence of session validation in the download handler represents a significant deviation from secure coding practices for embedded network protocols. To mitigate this risk, organizations must upgrade to version 1.1.1 or later where these checks have been implemented. In environments where upgrading is not immediately feasible, mitigation strategies should include strict physical segmentation of CAN networks, deployment of hardware-based firewalls that filter based on node ID and message type rather than just content, and the implementation of additional application-layer security gateways that can validate SDO transaction states before forwarding them to vulnerable devices. Long-term solutions involve adopting newer industrial protocols with native authentication features or implementing cryptographic signing for critical configuration updates where supported by device firmware.