CVE-2026-82357

RT-Labs AB C-Open CANopen NULL pointer dereference

Published Oct 1, 2026 CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Description

RT-Labs AB C-Open CANopen contains a NULL pointer dereference if the LSS protocol is used to configure the device. An object defined by the user application may not have all required subindexes for object 0x1018. An unauthenticated, remote attacker with access to the CAN bus, through a compromised node for instance, can initiate the LSS protocol on a device with a misconfigured identity object and potentially crash the device. Fixed in 1.1.1.

Analysis

Technical impact

RT‑Labs AB C‑Open contains a NULL pointer dereference that is triggered when the Layer Settings Selector (LSS) protocol is used to configure a device whose identity object 0x1018 lacks required sub‑indices. The improperly initialized sub‑indexes cause the firmware to dereference a null pointer, leading to an application crash. The vulnerability is not a data leak or execution flaw but results in a denial of service by rendering the device inoperable.

Affected Systems

The affected product is RT‑Labs AB’s C‑Open implementation. All releases prior to v1.1.1 are vulnerable; the fix is available in the 1.1.1 release. Users who run earlier versions of C‑Open on their CANopen devices are impacted.

Risk and Exploitability

The CVSS score of 7.1 indicates a high risk of disruption. EPSS data is not available, but the need for an attacker to have access to the CAN bus—a local or compromised node—means that the vulnerability is exploitable only when the attacker can send LSS commands to the target. The flaw is unauthenticated and could be triggered by malicious nodes on the same network, potentially leading to widespread device failures. The vulnerability is not listed in the CISA KEV catalog, but the severity and the requirement for physical network access still warrant prompt remediation.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

RT-Labs AB

C-Open

affected

Version	Status	Constraints
`0`	affected	< 1.1.1
`1.1.1`	unaffected	—

No data.

Vendor Product Versions

Rt-labs Ab

C-open

Version	Status	Scheme	Platform
`[0,1.1.1)`	affected	semver	—
`1.1.1`	unaffected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade C‑Open to version 1.1.1 or later
Validate that all required sub‑indexes for object 0x1018 are defined before enabling LSS
If a patch is not yet available, isolate the device or restrict LSS access to trusted nodes until a fix is deployed

Generated by OpenCVE AI on October 1, 2026 at 21:58 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.287% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/rtlabs-com/c-open/releases/tag/public%2Fv1.1.1
https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-26-275-02.json
https://rt-labs.com/wp-content/uploads/2026/09/RRTL-260929-01.pdf
https://www.cve.org/CVERecord?id=CVE-2026-82357

History

Nov 10, 2026 9:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Oct 2, 2026 3:15 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Rt-labs Ab Rt-labs Ab c-open
Vendors & Products		Rt-labs Ab Rt-labs Ab c-open

Oct 1, 2026 8:00 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		RT-Labs AB C-Open CANopen contains a NULL pointer dereference if the LSS protocol is used to configure the device. An object defined by the user application may not have all required subindexes for object 0x1018. An unauthenticated, remote attacker with access to the CAN bus, through a compromised node for instance, can initiate the LSS protocol on a device with a misconfigured identity object and potentially crash the device. Fixed in 1.1.1.
Title		RT-Labs AB C-Open CANopen NULL pointer dereference
Weaknesses		CWE-476
References		https://github.com/rtlabs-com/c-open/releases/tag/public%2Fv1.1.1 https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-26-275-02.json https://rt-labs.com/wp-content/uploads/2026/09/RRTL-260929-01.pdf https://www.cve.org/CVERecord?id=CVE-2026-82357
Metrics		cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}` cvssV4_0 `{'score': 7.1, 'vector': 'CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}`