The flaw resides in the CANopen SDO server’s handling of download-segment frames, where the implementation does not verify that a download session is active or that write permissions are granted. An attacker can initiate an SDO upload for a read‑only Object Dictionary entry, capture a data pointer, and then send download‑segment frames that overwrite the memory location, effectively modifying protected configuration data. This unauthorized memory write can compromise system integrity, leading to accidental data corruption, service disruption, or a foothold for further compromise.

The vulnerability affects RT‑Labs AB C‑Open devices running any firmware version older than 1.1.1; versions 1.1.1 and later contain the fix. The flaw is present in the co_sdo_server.c module of the C‑Open implementation.

The CVSS score of 7.1 indicates a high impact when exploitation succeeds. EPSS data is not available, and the issue is not listed in CISA KEV, meaning no known large‑scale exploitation is reported yet. The attack vector is physical or local via the CAN bus, which does not provide authentication for CANopen messages; therefore any node connected to the bus can trigger the two‑frame sequence needed for the write. Successful exploitation requires only the ability to inject CAN frames, which is feasible in many industrial environments where physical access or malicious insiders are possible. Given these conditions, the risk of exploitation is moderate to high for exposed networks.