Read the docs
TI-2026-70093 Aliases CVE-2026-75348

Out-of-bounds read in EIPStackGroup OpENer EtherNet/IP parser

Priority HIGH 66CWE-125Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-125 and the CVSS impact.

Summary

EIPStackGroup OpENer v2.3 and master up to commit 76b95cf are affected. The EtherNet/IP TCP SendRRData Common Packet Format parser reads optional socket address items of types 0x8000 and 0x8001 without first checking that the buffer holds the complete sockaddr structure (CWE-125). A remote attacker without privileges or user interaction can cause a denial of service.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

An out-of-bounds read vulnerability exists in EIPStackGroup OpENer v2.3 and master up to commit 76b95cf in the EtherNet/IP TCP SendRRData Common Packet Format parser. The issue occurs in CreateCommonPacketFormatStructure() when it parses recognized optional socket address information items of type 0x8000 or 0x8001 without first validating that the remaining CPF buffer contains the complete fixed sockaddr structure. This allows a remote attacker to cause a denial of service.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00505 43rd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for OpENer.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-09 Threatist record created from CVE-2026-75348
  2. 2026-10-10 Affected versions changed · Red Hat
  3. 2026-10-10 CVSS score added · Red Hat

References

Other 4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences