Read the docs
TI-2026-56788 Aliases CVE-2026-82358GHSA-grg4-frf9-pvw5

RT-Labs AB C-Open CANopen SDO Server Write Protection Bypass

Priority LOW 31CWE-863Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-863.

Summary

RT-Labs AB C-Open CANopen contains a write protection bypass in the SDO (Service Data Object) server implementation 'src/co_sdo_server.c' that fails to properly validate write permissions when processing download-segment frames. An unauthenticated attacker on the CAN bus can initiate an SDO upload for a read-only Object Dictionary (OD) entry, which sets a data pointer to the read-only object, then send download-segment frames to write to that memory location. The download-segment handler does not verify that a download session is active, allowing any CANopen node to overwrite read-only OD entries using two SDO frames. Note that CANopen protocol operates over CAN bus and does not provide built-in authentication mechanisms. Fixed in 1.1.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00237 14th percentileScored 2026-11-07
Fix Fixed C-Open (RT-Labs AB): 1.1.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
RT-LabsC-Openbefore 1.1.11.1.1Patch availableCNA
  • C-Open VendorRT-Labs Affected before 1.1.1 Fixed in 1.1.1 Patch available CNA

Remediation

  • Fix · CNA C-Open (RT-Labs AB) Fixed in 1.1.1

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    RT-Labs C-Open — url

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2026-56787 RT-Labs AB C-Open CANopen NULL pointer dereferencePriority LOW 31
    Show all 2 records → Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-82358
  2. 2026-10-03 Alias added: GHSA-grg4-frf9-pvw5
  3. 2026-10-07 CISA SSVC decision points changed

References

Advisory 2

Other 2

  • TI-2026-82626 Out-of-bounds write when parsing AR Vendor Block requests in RT-Labs P-Net CVSS 4.0CRITICAL 9.3
  • TI-2026-82632 Resource exhaustion from RPC sessions kept for unknown interface requests CVSS 4.0HIGH 8.7
  • TI-2026-82630 NULL pointer dereference in RT-Labs P-Net on implicit read requests CVSS 4.0HIGH 8.7
  • TI-2026-82627 NULL pointer dereference in P-Net lets remote attackers crash devices CVSS 4.0HIGH 8.7
  • TI-2026-82625 Infinite loop in RT-Labs P-Net PDPortDataCheck record handling CVSS 4.0HIGH 8.7
  • TI-2025-23482 Out-of-bounds write in RT-Labs P-Net CVSS 3.1CRITICAL 9.8
See all 28 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences