CVE-2026-51537: Critical severity EIPStackGroup OpENer vulnerability
EIPStackGroup OpENer 2.3.0 (commit 76b95cf) has an out-of-bounds read issue in Connection Manager handling of ForwardOpen requests when processing short malformed packets. An attacker can send a valid ENIP outer frame carrying a malformed CIP ForwardOpen/LargeForwardOpen request, causing the parser to continue reading fields even when request data is insufficient. This issue is remotely triggerable via network traffic and does not require authentication.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments running EIPStackGroup OpENer 2.3.0 at commit 76b95cf are exposed if an attacker can send network traffic to the service. Exploitation does not require authentication.
What traffic is required to trigger the flaw?
An attacker must send a valid ENIP outer frame containing a malformed, short CIP ForwardOpen or LargeForwardOpen request. The malformed request causes Connection Manager parsing to read fields beyond the available request data.
Does exploitation require a valid application-level request?
The ENIP outer frame must be valid, but the encapsulated CIP ForwardOpen or LargeForwardOpen request is malformed. No credentials or user interaction are required.