CVE-2026-75348: High severity EIPStackGroup OpENer vulnerability

Q: Who is exposed to this issue?

Systems running EIPStackGroup OpENer v2.3 or master builds through commit 76b95cf are exposed if they accept EtherNet/IP TCP SendRRData requests. An unauthenticated remote attacker can trigger the issue over the network.

Q: What malformed input is required to trigger the denial of service?

The attacker must send a SendRRData Common Packet Format message containing a recognized optional socket address item of type 0x8000 or 0x8001 whose declared data does not include the complete fixed sockaddr structure. The parser reads beyond the remaining CPF buffer because it does not validate that sufficient data is present.

Q: Is authentication or user interaction required?

No. The reported vector is network-accessible, requires no privileges or user interaction, and affects availability rather than confidentiality or integrity.

Published Oct 9, 2026

Updated

An out-of-bounds read vulnerability exists in EIPStackGroup OpENer v2.3 and master up to commit 76b95cf in the EtherNet/IP TCP SendRRData Common Packet Format parser. The issue occurs in CreateCommonPacketFormatStructure() when it parses recognized optional socket address information items of type 0x8000 or 0x8001 without first validating that the remaining CPF buffer contains the complete fixed sockaddr structure. This allows a remote attacker to cause a denial of service.

Affected Software

1 affected component

EIPStackGroup OpENer=2.3, <=76b95cf

Event History

Oct 9, 2026

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

DescriptionSeverity

Frequently Asked Questions

Who is exposed to this issue?

Systems running EIPStackGroup OpENer v2.3 or master builds through commit 76b95cf are exposed if they accept EtherNet/IP TCP SendRRData requests. An unauthenticated remote attacker can trigger the issue over the network.

What malformed input is required to trigger the denial of service?

The attacker must send a SendRRData Common Packet Format message containing a recognized optional socket address item of type 0x8000 or 0x8001 whose declared data does not include the complete fixed sockaddr structure. The parser reads beyond the remaining CPF buffer because it does not validate that sufficient data is present.

Is authentication or user interaction required?

No. The reported vector is network-accessible, requires no privileges or user interaction, and affects availability rather than confidentiality or integrity.

CVE-2026-75348: High severity EIPStackGroup OpENer vulnerability

Affected Software

Event History

Frequently Asked Questions

Who is exposed to this issue?

What malformed input is required to trigger the denial of service?

Is authentication or user interaction required?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What malformed input is required to trigger the denial of service?

Is authentication or user interaction required?