An attacker can send a crafted ENIP/CPF message that supplies an attacker-controlled item_count value not properly checked against the remaining data_length of the CPF slice. This omission allows the CPF parser in OpENer create function to read past the bounds of the buffer, which can expose sensitive memory contents or trigger a crash. The direct effect is information disclosure or denial of service, depending on how the read is exploited.

The vulnerability is present in OpENer version 2.3-558-g1e99582, a firmware component from the EIPStackGroup project that implements the Common Packet Format parser for ENIP messages.

The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, indicating no widely observed exploitation. However, the affected component processes network traffic, so the likely attack vector is remote via network, and devices running the vulnerable firmware are exposed to potential memory disclosure or application crashes. With no publicly reported attacks, the current exploitation risk is uncertain, but due to potential for information leakage the risk should be considered moderate to high until a patch is applied. The CVSS score for this vulnerability is 6.2, indicating a moderate level of risk.