EIPStackGroup OpENer Get_Attribute_List CPF buffer overflow (DoS)

#!/usr/bin/env python3
# noisgate verifier — CVE-2026-51221 / OpENer ENIP fingerprint
# Usage: python3 check_opener.py <target_ip> [timeout_seconds]
# Exit: 0 PATCHED-or-not-OpENer, 1 VULNERABLE-candidate, 2 UNKNOWN
import socket, struct, sys

def list_identity(ip, timeout=3.0):
    # ENIP encapsulation header: command=0x0063 (ListIdentity), len=0, session=0, status=0, ctx=0, opt=0
    pkt = struct.pack('<HHIIQI', 0x0063, 0, 0, 0, 0, 0)
    s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
    s.settimeout(timeout)
    try:
        s.sendto(pkt, (ip, 44818))
        data, _ = s.recvfrom(4096)
        return data
    except socket.timeout:
        return None
    finally:
        s.close()

def parse_product_name(reply):
    # Skip 24-byte ENIP header, then CPF: item_count(2), type(2), len(2), then identity payload
    try:
        body = reply[24:]
        # item_count + type_id + length
        type_id, length = struct.unpack('<HH', body[2:6])
        ident = body[6:6+length]
        # identity: encap_proto(2) sock(16) vendor(2) device_type(2) product_code(2) rev(2) status(2) serial(4) name_len(1) name(N)
        name_len = ident[32]
        name = ident[33:33+name_len].decode('ascii', errors='replace')
        return name
    except Exception:
        return None

def main():
    if len(sys.argv) < 2:
        print('usage: check_opener.py <ip> [timeout]')
        sys.exit(2)
    ip = sys.argv[1]
    t = float(sys.argv[2]) if len(sys.argv) > 2 else 3.0
    reply = list_identity(ip, t)
    if reply is None:
        print(f'UNKNOWN  no ENIP response from {ip}:44818')
        sys.exit(2)
    name = parse_product_name(reply) or ''
    print(f'product_name={name!r}')
    lower = name.lower()
    if 'opener' in lower or 'eipstackgroup' in lower:
        print(f'VULNERABLE  candidate OpENer-derived firmware on {ip} — verify build against commit 76b95c+ patch')
        sys.exit(1)
    print(f'PATCHED  no OpENer fingerprint on {ip} (still confirm via OEM SBOM)')
    sys.exit(0)

if __name__ == '__main__':
    main()