Out-of-Bounds Read in OpENer EtherNet/IP Parser

Executive Summary

CVE-2026-75351 is a stack-buffer-overflow vulnerability in OpENer v2.3 that occurs in the server-side EtherNet/IP ForwardOpen connection-path parser. The issue stems from a mismatch between the parser's position and the remaining path length due to incorrect accounting of 32-bit logical segments. When small numeric segments are encoded as 32-bit values, the parser advances by the encoded width, but the remaining path length is decremented incorrectly, causing the parser to read beyond the packet's end. This leads to a stack-buffer-overflow when an out-of-bounds pointer is dereferenced.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor for crashes or abnormal termination of OpENer processes handling EtherNet/IP ForwardOpen requests. Check logs for stack-buffer-overflow errors or segmentation faults. Use network traffic analysis tools like Wireshark to inspect EtherNet/IP packets for malformed ForwardOpen requests with inconsistent segment widths.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can be exploited remotely without authentication by sending a specially crafted ForwardOpen request to the OpENer server. The attack triggers a denial-of-service condition by causing a stack-buffer-overflow, which may crash the application or the entire system. Since OpENer is used in EtherNet/IP-compliant I/O adapter devices, this could disrupt industrial control systems or networked devices relying on this software.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability causes a denial of service by triggering a stack-buffer-overflow in the EtherNet/IP stack. It does not directly impact data confidentiality or integrity but may disrupt operations in systems handling sensitive data. Compliance with GDPR or HIPAA could be indirectly affected if the DoS disrupts services processing personal or health data, potentially leading to availability issues.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update OpENer to the latest patched version if available. If no patch exists, disable the ForwardOpen service or restrict network access to OpENer instances. Implement deep packet inspection to filter malformed EtherNet/IP packets. Monitor for exploitation attempts and apply network segmentation to limit exposure.

Useful 0 Not Useful 0