CVE-2026-51536
published 2026-07-13CVE-2026-51536: In OpENer 2.3.0 (commit 76b95cf) when parsing incoming CIP (Common Industrial Protocol) network packets, the length parameter is inconsistently typed across…
PriorityP355critical9.1CVSS 3.1
AVNACLPRNUINSUCHINAH
EPSS
0.49%
41.3th percentile
In OpENer 2.3.0 (commit 76b95cf) when parsing incoming CIP (Common Industrial Protocol) network packets, the length parameter is inconsistently typed across the call stack. Specifically, an upstream length calculated as an int is passed to a downstream function that expects an EipInt16 (a 16-bit signed integer). If a maliciously crafted packet with specific length fields is processed, the length parameter can overflow or be truncated into a negative value. This negative length bypasses subsequent bounds checking (due to signed/unsigned comparison issues) and is ultimately used in memory operations, leading to a Stack Buffer Overflow when reading data in DecodePaddedEPath.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| opener_project | opener | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
In OpENer 2.3.0 (commit 76b95cf) when parsing incoming CIP (Common Industrial Protocol) network packets, the length parameter is inconsistently typed across the call stack.
ghsa_unreviewed·2026-07-14
CVE-2026-51536 [CRITICAL] CWE-190 In OpENer 2.3.0 (commit 76b95cf) when parsing incoming CIP (Common Industrial Protocol) network packets, the length parameter is inconsistently typed across the call stack.
In OpENer 2.3.0 (commit 76b95cf) when parsing incoming CIP (Common Industrial Protocol) network packets, the length parameter is inconsistently typed across the call stack. Specifically, an upstream length calculated as an int is passed to a downstream function that expects an EipInt16 (a 16-bit signed integer). If a maliciously crafted packet with specific length fields is processed, the length parameter can overflow or be truncated into a negative value. This negative length bypasses subsequent bounds checking (due to signed/unsigned comparison issues) and is ultimately used in memory operations, leading to a Stack Buffer Overflow when reading data in DecodePaddedEPath.
VulDB
Across OpENer 2.3.0 CIP Packet DecodePaddedEPath length stack-based overflow
vuldb·2026-07-13
CVE-2026-51536 Across OpENer 2.3.0 CIP Packet DecodePaddedEPath length stack-based overflow
A vulnerability was found in Across OpENer 2.3.0. It has been declared as very critical. Impacted is the function DecodePaddedEPath of the component CIP Packet Handler. The manipulation of the argument length results in stack-based buffer overflow.
This vulnerability is cataloged as CVE-2026-51536. The attack may be launched remotely. There is no exploit available.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-07-13
Published