Technical impact
A stack buffer overflow occurs when OpENer 2.3.0 parses CIP packets because an upstream length field calculated as an int is passed to a downstream function that expects a 16-bit signed integer, allowing maliciously crafted packets to produce negative or truncated lengths. The negative length bypasses bounds checks due to signed/unsigned mismatches and is subsequently used in memory operations during DecodePaddedEPath, enabling an attacker to corrupt the stack and execute arbitrary code, which compromises confidentiality, integrity, and availability.
Affected Systems
Devices running OpENer 2.3.0 (commit 76b95cf) are vulnerable; earlier or patched releases are not affected.
Risk and Exploitability
The CVSS score of 9.1 signals a high‑severity vulnerability. The EPSS score is less than 1%, indicating a very low current probability of exploitation, yet the flaw remains a critical stack buffer overflow that can be triggered by network‑based crafted CIP packets. It is not listed in the CISA KEV catalog. An attacker with network access capable of transmitting such packets can potentially achieve remote code execution on the affected device.
