Technical impact
The vulnerability is an incorrect access control flaw in EIPStackGroup OpENer 2.3.0. When the server processes critical encapsulation commands, it checks that the supplied session_handle exists in the global list but does not verify that the handle belongs to the TCP connection making the request. Because session handles are not tightly bound to originating sockets, an attacker can forge a request using a handle that belongs to another legitimate client and bypass the intended access controls, enabling unauthorized operation. This flaw corresponds to CWE‑284, which reflects an improper authorization check and can lead to privileged command execution if the server permits actions behind the protected encapsulation interface.
Affected Systems
EIPStackGroup OpENer version 2.3.0 is affected. Vendor and product names are EIPStackGroup and OpENer; the CVE data does not list additional vendor or product variants.
Risk and Exploitability
The CVSS score of 9.1 indicates a critical severity. EPSS < 1% suggests a low probability of exploitation in the wild, and the vulnerability is not presently listed in the CISA KEV catalog. The likely attack vector is a network-based attacker who can reach the OpENer service over TCP. An attacker only needs knowledge of a valid session handle created by an authenticated client and network connectivity to the service. With these conditions, the attacker can covertly issue encapsulation commands with the borrowed handle, effectively bypassing authorization and gaining unauthorized control over the device's encapsulation functionality.
