The SOEM firmware receives an error response from a device and clears an internal pointer. The code, however, continues to process subsequent messages. If another message arrives before a timeout, the master attempts to use the cleared pointer and crashes. An attacker can trigger this scenario by sending two carefully crafted messages, resulting in a predictable denial of service.

Vendors affected are RT‑Labs AB providing the SOEM (Simple Open EtherCAT Master) implementation. The vulnerability exists in SOEM version 2.0.0 and all earlier releases. Systems running these versions and connected to a network of EtherCAT slave devices are at risk.

With a CVSS score of 6.5 the flaw is considered moderate severity. EPSS data is not available, so the likelihood of exploitation cannot be quantified from public metrics. The vulnerability is not listed in the CISA KEV catalogue. The attack can be carried out remotely by a device that can send EtherCAT frames to the master, so a malicious actor on the same local network could use the simple two‑message sequence to force a master crash.