CyberRota Analysis
AI-GeneratedThe vulnerability arises from improper handling of the length parameter in OpENer 2.3.0 during the parsing of CIP network packets, where an integer is incorrectly passed to a function expecting a 16-bit signed integer. This inconsistency can be exploited by sending specially crafted packets, resulting in a stack buffer overflow that may allow attackers to execute arbitrary code or crash the application. Organizations using OpENer for industrial automation should prioritize patching this critical vulnerability to mitigate potential exploitation risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
In OpENer 2.3.0 (commit 76b95cf) when parsing incoming CIP (Common Industrial Protocol) network packets, the length parameter is inconsistently typed across the call stack. Specifically, an upstream length calculated as an int is passed to a downstream function that expects an EipInt16 (a 16-bit signed integer). If a maliciously crafted packet with specific length fields is processed, the length parameter can overflow or be truncated into a negative value. This negative length bypasses subsequent bounds checking (due to signed/unsigned comparison issues) and is ultimately used in memory operations, leading to a Stack Buffer Overflow when reading data in DecodePaddedEPath.
Related CVEs
Other vulnerabilities affecting the same vendor(s)