OpENer 2.3.0 contains an out-of-bounds read flaw in its CIP message parser (CWE-125). When parsing a CIP request, an attacker can forge the path_size field to claim many more path words than are actually present. The parser blindly trusts this attacker-controlled value and continues decoding path segments without checking the remaining length, causing it to read beyond the limits of the receive buffer and potentially expose sensitive data.

The vulnerability affects OpENer 2.3.0 (commit 76b95cf). Any deployment running this version on a network that receives ENIP SendRRData frames is susceptible.

The flaw is exploitable over the EtherNet/IP protocol; an attacker only needs to send a crafted ENIP SendRRData frame from outside the protected network. The CVSS score of 9.1 reflects high severity, indicating that an out-of-bounds read could lead to data disclosure. The EPSS score is <1%, showing very low probability of exploitation, and the issue is not listed in the CISA KEV catalog. Because the vulnerability allows memory disclosure remotely, systems exposed to EtherNet/IP traffic should prioritize remediation.