A buffer overflow in the Get_Attribute_List function of EIPStackGroup OpENer commit 76b95c

CVE-2026-51221 is a buffer overflow in Get_Attribute_List inside EIPStackGroup OpENer at commit 76b95c. An attacker who can reach TCP/UDP 44818 (EtherNet/IP) sends a malformed Common Packet Format (CPF) frame and the device crashes — confidentiality and integrity are untouched (C:N/I:N), only availability (A:H). OpENer is an open-source ENIP adapter reference implementation primarily embedded into PLCs, remote I/O, drives, and ICS gateways by OEMs that don't license the ODVA stack. Affected: the 76b95c commit and any downstream firmware that vendored OpENer without applying upstream CPF length-validation patches.

The vendor 7.5 (AV:N/AC:L/PR:N/UI:N/A:H) reflects a pure-DoS unauth network bug — that's a *fair textbook score* but it overstates real-world risk in two directions and understates it in one. Overstates: OpENer is a niche reference stack; most OT operators don't deploy it directly, and ENIP/44818 should never be reachable from corporate or internet (and is largely not — Shodan typically shows <10k ENIP devices internet-exposed globally, of which OpENer-derived firmware is a sliver). Understates: in the OT contexts where it IS deployed, a crash on a controller can equal a process trip, a safety event, or a line stop. Net: MEDIUM for the IT defender population, HIGH for any operator who can confirm OpENer-derived firmware in the safety/control loop.

Why this verdict

• Impact is DoS-only — C:N/I:N/A:H means no code execution, no data exfil; floor of harm is a controller crash, not domain takeover.
• Exposure population is small — OpENer is a reference implementation; mainstream PLC vendors (Rockwell, Siemens) use their own ENIP stacks. Real footprint sits in niche OEM gateways and remote I/O.
• ENIP is OT-segment-only — port 44818 reachable from corporate or internet implies a segmentation failure that is itself the bigger finding. Properly Purdue-segmented sites are unreachable.
• Role multiplier: on a workstation or HMI — N/A (OpENer doesn't run there). On a typical line-of-business server — N/A. On a PLC / remote I/O / safety-adjacent controller, a sustained crash loop can cascade to process trip or batch loss; this is the floor-setting role and it keeps the verdict from collapsing to LOW.
• No KEV, EPSS 0.0017 — no active campaigns, exploitation probability is bottom decile.
• No RCE primitive published — the bug is a parser overflow into a DoS pattern, not a documented control-flow hijack on embedded RTOS without ASLR/canaries; weaponization to RCE is plausible but unproven.

Why not higher?

Not HIGH because the CVSS impact triplet caps at A:H with no C or I. There is no public RCE PoC, no KEV listing, no active exploitation, and the affected component is a niche open-source stack with low installed base relative to mainstream ENIP implementations. Pushing to HIGH would require either evidence of weaponization or confirmation that a widely-deployed safety-critical OEM ships unpatched OpENer.

Why not lower?

Not LOW because the bug is unauthenticated, network-reachable, single-packet with availability impact on devices that may sit in control or safety loops. In OT contexts a DoS on a controller is not a nuisance — it is a process event. The floor is set by the worst plausible deployment role (a vendored OpENer in a PLC), and that role keeps this above LOW.

1. Inventory OpENer in your firmware supply chain — Query OEM PSIRTs and SBOMs for any device that bundles EIPStackGroup OpENer. Without an inventory you cannot scope this CVE. Complete within 30 days per noisgate MEDIUM treatment (no mitigation SLA, but inventory is prerequisite work).
2. Enforce strict ENIP egress/ingress filtering at the IT/OT boundary — Block TCP/UDP 44818 across Purdue Level 3↔3.5↔4 boundaries; permit only between known ENIP scanner/originator and target pairs. This neutralizes the unauth-network prerequisite for any caller outside the control LAN.
3. Deploy ENIP malformed-CPF detection in OT IDS — Enable Claroty/Nozomi/Dragos or Snort/Suricata ENIP anomaly rules for oversized attribute list payloads. Alert on repeated CPF parser faults from a single source.
4. Validate watchdog and fail-safe behavior — For any controller suspected to embed OpENer, confirm with the OEM that the ENIP task is watchdog-restarted and that crash does not cascade to the safety subsystem.
5. Apply vendor firmware when available — Once OEMs ship backported firmware, schedule into the next maintenance window. noisgate remediation SLA: ≤ 365 days for MEDIUM.

Run this on an auditor workstation that has L3 reach to the OT LAN, e.g. python3 check_opener.py 10.20.30.40. It sends an ENIP List Identity request (UDP 44818) and parses the Product Name string to flag OpENer-derived firmware. Requires no privileges beyond outbound UDP. Do NOT run during production-critical operations without change approval.

#!/usr/bin/env python3
# noisgate verifier — CVE-2026-51221 / OpENer ENIP fingerprint
# Usage: python3 check_opener.py <target_ip> [timeout_seconds]
# Exit: 0 PATCHED-or-not-OpENer, 1 VULNERABLE-candidate, 2 UNKNOWN
import socket, struct, sys

def list_identity(ip, timeout=3.0):
    # ENIP encapsulation header: command=0x0063 (ListIdentity), len=0, session=0, status=0, ctx=0, opt=0
    pkt = struct.pack('<HHIIQI', 0x0063, 0, 0, 0, 0, 0)
    s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
    s.settimeout(timeout)
    try:
        s.sendto(pkt, (ip, 44818))
        data, _ = s.recvfrom(4096)
        return data
    except socket.timeout:
        return None
    finally:
        s.close()

def parse_product_name(reply):
    # Skip 24-byte ENIP header, then CPF: item_count(2), type(2), len(2), then identity payload
    try:
        body = reply[24:]
        # item_count + type_id + length
        type_id, length = struct.unpack('<HH', body[2:6])
        ident = body[6:6+length]
        # identity: encap_proto(2) sock(16) vendor(2) device_type(2) product_code(2) rev(2) status(2) serial(4) name_len(1) name(N)
        name_len = ident[32]
        name = ident[33:33+name_len].decode('ascii', errors='replace')
        return name
    except Exception:
        return None

def main():
    if len(sys.argv) < 2:
        print('usage: check_opener.py <ip> [timeout]')
        sys.exit(2)
    ip = sys.argv[1]
    t = float(sys.argv[2]) if len(sys.argv) > 2 else 3.0
    reply = list_identity(ip, t)
    if reply is None:
        print(f'UNKNOWN  no ENIP response from {ip}:44818')
        sys.exit(2)
    name = parse_product_name(reply) or ''
    print(f'product_name={name!r}')
    lower = name.lower()
    if 'opener' in lower or 'eipstackgroup' in lower:
        print(f'VULNERABLE  candidate OpENer-derived firmware on {ip} — verify build against commit 76b95c+ patch')
        sys.exit(1)
    print(f'PATCHED  no OpENer fingerprint on {ip} (still confirm via OEM SBOM)')
    sys.exit(0)

if __name__ == '__main__':
    main()

Sources

1. Claroty Team82 — OpENer ENIP stack vulnerability research
2. EIPStackGroup/OpENer GitHub — Issue #558 (CPF parsing OOB read lineage)
3. EIPStackGroup/OpENer repository
4. CISA Known Exploited Vulnerabilities Catalog
5. FIRST EPSS model documentation
6. ODVA — EtherNet/IP / CIP specification reference
7. NIST NVD — CVE record lookup
8. Tenable CVE database