Description
OpENer v2.3.0 / commit 76b95cf contains an out-of-bounds read in the unconnected explicit messaging path. This allows a remote attacker to cause a denial of service.
Published: 2026-10-09
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Update
AI Analysis

Impact

OpENer v2.3.0 contains an out-of-bounds read in the unconnected explicit messaging path. The flaw is triggered when a remote actor sends a crafted message, causing the software to read beyond allocated memory and crash. The result is a denial of service that removes the affected service from operation without compromising data or credentials.

Affected Systems

The vulnerability is present in OpENer version 2.3.0 as described by the listed commit. No vendor names are supplied, but the affected system is the OpENer open‑source stack used for industrial Ethernet/IP communication.

Risk and Exploitability

The CVSS score of 7.5 reflects a high impact for denial of service. The EPSS score is <1%, indicating a very low but nonzero probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, but due to the remote attack vector and the significant availability impact, addressing this flaw remains a priority, especially for systems exposed to untrusted networks.

Generated by OpenCVE AI on October 17, 2026 at 10:51 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to the latest OpENer release that includes a fix for the out-of-bounds read in the explicit messaging path; if an update is not feasible, isolate the affected service behind a firewall that restricts explicit messaging traffic.
  • Apply the specific commit 76b95cf patch to the source code or build a patched binary if the upstream release schedule is slow.
  • Monitor system logs for abnormal crashes or repeated message failures, and correlate them with external network activity to detect potential exploitation attempts.

Generated by OpenCVE AI on October 17, 2026 at 10:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 17 Oct 2026 11:15:00 +0000

Type Values Removed Values Added
Title Out‑of‑Bounds Read in OpENer v2.3.0 Allowing Remote Denial of Service

Sat, 17 Oct 2026 09:15:00 +0000

Type Values Removed Values Added
Title Out‑of‑Bounds Read in OpENer Enables Remote Denial of Service
Weaknesses CWE-125

Tue, 13 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-400
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 09 Oct 2026 18:00:00 +0000

Type Values Removed Values Added
First Time appeared Eipstackgroup
Eipstackgroup opener
Vendors & Products Eipstackgroup
Eipstackgroup opener

Fri, 09 Oct 2026 17:45:00 +0000

Type Values Removed Values Added
Title Out‑of‑Bounds Read in OpENer Enables Remote Denial of Service
Weaknesses CWE-125

Fri, 09 Oct 2026 16:00:00 +0000

Type Values Removed Values Added
Description OpENer v2.3.0 / commit 76b95cf contains an out-of-bounds read in the unconnected explicit messaging path. This allows a remote attacker to cause a denial of service.
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AC:L/AV:N/A:H/C:N/I:N/PR:N/S:U/UI:N'}

Subscriptions

Eipstackgroup Opener
cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2026-10-13T16:31:53.464Z

Reserved: 2026-08-17T00:00:00.000Z

Link: CVE-2026-75345

cve-icon Vulnrichment

Updated: 2026-10-13T16:29:28.374Z

cve-icon NVD

Status : Deferred

Published: 2026-10-09T16:17:29.430

Modified: 2026-10-13T17:17:45.667

Link: CVE-2026-75345

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-17T11:00:07Z

Weaknesses
  • CWE-400

    Uncontrolled Resource Consumption