CVE-2026-82357: RT-Labs AB C-Open CANopen NULL pointer dereference
RT-Labs AB C-Open CANopen contains a NULL pointer dereference if the LSS protocol is used to configure the device. An object defined by the user application may not have all required subindexes for object 0x1018. An unauthenticated, remote attacker with access to the CAN bus, through a compromised node for instance, can initiate the LSS protocol on a device with a misconfigured identity object and potentially crash the device. Fixed in 1.1.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
RT-Labs AB C-Open CANopento a version that resolves this vulnerability.Fixed in 1.1.1
Event History
Frequently Asked Questions
Who is exposed to exploitation?
Devices running RT-Labs C-Open CANopen with a misconfigured 0x1018 identity object are exposed if an attacker can access the CAN bus, including through a compromised node.
What does an attacker need to trigger the issue?
The attacker does not need authentication or user interaction. They need CAN-bus access and must initiate the LSS protocol against a device whose user-defined 0x1018 object lacks required subindexes.
Are all deployments affected by default?
The issue depends on the device's application-defined identity object configuration. The provided information identifies risk when object 0x1018 does not include all required subindexes; it does not state that all default deployments are affected.
How can the issue be remediated?
Update to C-Open CANopen version 1.1.1, which contains the fix. Also verify that the application-defined object 0x1018 includes all required subindexes.