TI-2026-37498 Aliases CVE-2026-51536 GHSA-wfpp-whc2-qj45

In OpENer 2.3.0 (commit 76b95cf) when parsing incoming CIP (Common Industrial Protocol)…

HIGH 80CWE-190Published 2026-07-13 · Updated 2026-07-14

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · None · High
Fix status: No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.

Summary

In OpENer 2.3.0 (commit 76b95cf) when parsing incoming CIP (Common Industrial Protocol) network packets, the length parameter is inconsistently typed across the call stack. Specifically, an upstream length calculated as an int is passed to a downstream function that expects an EipInt16 (a 16-bit signed integer). If a maliciously crafted packet with specific length fields is processed, the length parameter can overflow or be truncated into a negative value. This negative length bypasses subsequent bounds checking (due to signed/unsigned comparison issues) and is ultimately used in memory operations, leading to a Stack Buffer Overflow when reading data in DecodePaddedEPath.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00628 50th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: Yes
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA

— Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:opener_project:opener:2.3.0:::::::*	2.3.0	Vulnerable	EIPStackGroup

cpe:2.3:a:opener_project:opener:2.3.0:*:*:*:*:*:*:* Versions 2.3.0 Vulnerable ·EIPStackGroup

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2026-51536
2026-10-03 Alias added: GHSA-wfpp-whc2-qj45
2026-10-30 EPSS moved to the 50th–90th percentile

References

Exploit 1

https://github.com/EIPStackGroup/OpENer/issues/563

Advisory 1

https://gist.github.com/MrAlaskan/e160c626a32e03e5d9eddaa732560672

TI-2026-37502 OpENer 2.3.0 (master branch up to commit 76b95cf) is vulnerable to a severe memory… CVSS 3.1CRITICAL 9.8
TI-2022-21373 Out-of-bounds write in EIPStackGroup OpENer CVSS 3.1CRITICAL 10.0
TI-2022-21372 Out-of-bounds write in EIPStackGroup OpENer CVSS 3.1CRITICAL 10.0
TI-2026-37503 OpENer 2.3.0 (commit 76b95cf) has an out-of-bounds read issue in CIP message parsing when… CVSS 3.1CRITICAL 9.1
TI-2026-37500 EIPStackGroup OpENer 2.3.0 (commit 76b95cf) suffers from an Incorrect Access Control… CVSS 3.1CRITICAL 9.1
TI-2026-37499 EIPStackGroup OpENer 2.3.0 (commit 76b95cf) has an out-of-bounds read issue in Connection… CVSS 3.1CRITICAL 9.1

See all 15 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences