The vulnerability arises from integer underflow and overflow conditions in the SOEM message length validation routine. An attacker sending a specially crafted packet can cause the master to compute a negative or excessively large length, bypassing bounds checks and writing beyond allocated memory. This memory corruption can overwrite control data and enables arbitrary code execution on the master controller.

Vulnerable versions are SOEM 2.0.0 and all earlier releases from RT‑Labs AB. Any device running those releases on a network where an untrusted node can communicate with the SOEM master is susceptible. The flaw exists in the core EtherCAT master library distributed by RT‑Labs.

The CVSS score of 8.3 reflects a high severity, and the lack of an EPSS score indicates no current exploit data are publicly available, though the KEV status is not listed. Based on the description, it is inferred that the attack vector is network-based; control or management traffic from an adversarial device could deliver the crafted message. While the vulnerability is exploitable with sufficient network access, no public proof‑of‑concept is currently known.