TI-2026-37500 Aliases CVE-2026-51538 GHSA-jcwf-w8h2-gq3f

EIPStackGroup OpENer 2.3.0 (commit 76b95cf) suffers from an Incorrect Access Control…

HIGH 80CWE-284Published 2026-07-13 · Updated 2026-07-14

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · None
Fix status: No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-284.

Summary

EIPStackGroup OpENer 2.3.0 (commit 76b95cf) suffers from an Incorrect Access Control vulnerability in its handling of encapsulation sessions. When the server processes critical encapsulation commands, it verifies whether the provided session_handle exists in the global session list, but it fails to verify whether that handle belongs to the specific TCP connection issuing the request. Because there is no strong binding between a session handle and its originating socket, any attacker on the network can use a valid session handle created by another legitimate client to bypass access controls.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00522 44th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: Yes
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA

— Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:opener_project:opener:2.3.0:::::::*	2.3.0	Vulnerable	EIPStackGroup

cpe:2.3:a:opener_project:opener:2.3.0:*:*:*:*:*:*:* Versions 2.3.0 Vulnerable ·EIPStackGroup

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2026-51538
2026-10-03 Alias added: GHSA-jcwf-w8h2-gq3f

References

Exploit 1

https://github.com/EIPStackGroup/OpENer/issues/565

Advisory 1

https://gist.github.com/MrAlaskan/8156ca3acd6754a9f66efede0a1351f2

TI-2026-37502 OpENer 2.3.0 (master branch up to commit 76b95cf) is vulnerable to a severe memory… CVSS 3.1CRITICAL 9.8
TI-2022-21373 Out-of-bounds write in EIPStackGroup OpENer CVSS 3.1CRITICAL 10.0
TI-2022-21372 Out-of-bounds write in EIPStackGroup OpENer CVSS 3.1CRITICAL 10.0
TI-2026-37503 OpENer 2.3.0 (commit 76b95cf) has an out-of-bounds read issue in CIP message parsing when… CVSS 3.1CRITICAL 9.1
TI-2026-37499 EIPStackGroup OpENer 2.3.0 (commit 76b95cf) has an out-of-bounds read issue in Connection… CVSS 3.1CRITICAL 9.1
TI-2026-37498 In OpENer 2.3.0 (commit 76b95cf) when parsing incoming CIP (Common Industrial Protocol)… CVSS 3.1CRITICAL 9.1

See all 15 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences