Description

A weakness has been identified in liftoff-sr CIPster 1802525be27d33e19a9a83c163e331a1d13b1892. This affects the function CipConnMgrClass::forward_open of the file cipconnectionmanager.cc of the component ForwardOpen Handler. Executing a manipulation of the argument product_code_ can lead to out-of-bounds read. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. This patch is called ea870a274bf68dfaa3f511f20e2fff6778fb7b74. A patch should be applied to remediate this issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-20T13:19:06.690Z",
  "pubdate": "2026-08-20T13:19:06.690Z",
  "executiveSummary": "An out-of-bounds read vulnerability has been identified in the liftoff-sr CIPster component, specifically within the ForwardOpen Handler. The flaw exists in the CipConnMgrClass::forward_open function located in cipconnectionmanager.cc at commit 1802525be27d33e19a9a83c163e331a1d13b1892. This vulnerability allows remote attackers to trigger an out-of-bounds read via the manipulation of the product_code_ argument. Successful exploitation of this weakness can lead to unauthorized information disclosure or application crashes, posing a reliability and confidentiality risk to industrial control systems utilizing the affected software. Public exploits are available, lowering the barrier to entry for potential threat actors. The vulnerability requires network access to the target service to execute the attack payload successfully.",
  "technicalDetails": "The vulnerability is an out-of-bounds read residing in the CipConnMgrClass::forward_open function of the cipconnectionmanager.cc file within the ForwardOpen Handler component of liftoff-sr CIPster (commit 1802525be27d33e19a9a83c163e331a1d13b1892). The root cause stems from insufficient bounds checking and validation of input parameters processed during the Common Industrial Protocol (CIP) Forward Open service request handling. Specifically, the argument designated as product_code_ is inadequately verified against expected buffer boundaries or array limits prior to memory access operations.\nAttack flow begins with a remote attacker interacting with the CIPster network service that implements the Common Industrial Protocol connection management. The attacker crafts a malicious CIP Forward Open request packet containing a manipulated product_code_ value designed to bypass logical constraints. When the CipConnMgrClass::forward_open function parses this input, it utilizes the tainted product_code_ as an index or offset without proper validation. Consequently, the application reads memory outside the allocated boundaries of the intended data structure.\nNetwork exposure is inherent to the service, as it listens for remote CIP communication requests. The attacker requires network connectivity to the target endpoint, but no prior authentication or elevated privileges are specified as prerequisites for triggering the parsing routine in this component. Depending on the memory layout and the specific data read, the payload behavior may result in severe application instability, leading to a denial of service (DoS) condition via segmentation fault, or the leakage of sensitive adjacent memory contents containing application state or credentials back to the requester."
}