Integer Underflow in OpENer EtherNet/IP Parser Causes DoS

Executive Summary

CVE-2026-75352 is a remote stack-based out-of-bounds read vulnerability in the OpENer EtherNet/IP stack. It occurs in the ParseConnectionPath() function when processing a crafted EtherNet/IP ForwardOpen request. The issue stems from incorrect accounting of the Production Inhibit Time (PIT) network segment length, causing a variable to underflow and read beyond the intended buffer.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor for crashes or instability in OpENer servers handling EtherNet/IP traffic on port 44818. Use network traffic analysis tools like Wireshark to inspect ForwardOpen requests for malformed connection paths. Enable AddressSanitizer or UndefinedBehaviorSanitizer during compilation to catch out-of-bounds reads.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause a denial of service by crashing the server when AddressSanitizer or UndefinedBehaviorSanitizer is enabled. In non-sanitized builds, it may lead to process instability or denial of service due to undefined behavior from reading past the stack-backed TCP receive buffer.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability primarily causes denial of service or process instability by triggering out-of-bounds memory reads. It does not directly impact data confidentiality or integrity, which are key concerns for GDPR and HIPAA. However, persistent denial of service could indirectly affect compliance by disrupting operations that handle protected data.

Useful 0 Not Useful 0

Mitigation Strategies

Apply the patch correcting the word accounting in ParseConnectionPath() to subtract 1 word for the PIT segment. Temporarily restrict access to port 44818 via firewall rules until patched. Monitor server logs for crashes or unusual activity related to EtherNet/IP traffic.

Useful 0 Not Useful 0