Description

An issue in the NetStaX EtherNet/IP Stack prior to v5.6.1 could allow a large Class 3 explicit-message request to exceed the application-side receive buffer without generating an error or warning. The result could be memory corruption, a device crash, or a potential remote attack vector without the originating device receiving a CIP error indicating that the request could not be processed.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-01T15:17:28.013Z",
  "pubdate": "2026-09-01T15:17:28.013Z",
  "executiveSummary": "The NetStaX EtherNet/IP Stack is susceptible to a buffer overflow vulnerability originating from improper handling of Class 3 explicit-message requests. This flaw allows a remote, unauthenticated attacker to transmit malformed or oversized requests that exceed the designated application-side receive buffer.\nBecause the stack fails to validate the size of incoming packets against available buffer constraints, the vulnerability can lead to memory corruption, denial-of-service conditions via device crashes, or arbitrary code execution.\nThe primary risk lies in the lack of an error-handling mechanism; the stack processes the overflowed payload without triggering CIP-level errors, effectively bypassing standard communication error reporting. This silence facilitates reliable exploitation, as the originating device receives no indication that the transmission failed or caused an exception.\nAffected systems are those utilizing versions of the NetStaX EtherNet/IP Stack prior to v5.6.1. Deployment in industrial control environments exposes devices to potential remote exploitation over the network, necessitating immediate update procedures to mitigate the risk of operational disruption or unauthorized control.",
  "technicalDetails": "The vulnerability is rooted in the inadequate bounds checking of incoming Class 3 explicit-message requests within the NetStaX EtherNet/IP Stack. EtherNet/IP, utilizing the Common Industrial Protocol (CIP), relies on structured request/response cycles. When the stack receives a Class 3 request, it allocates a fixed-size buffer for the incoming data packet.\nThe technical failure occurs during the processing stage, where the application-side buffer management logic fails to enforce length validation against the actual payload size contained within the incoming CIP request. When a specially crafted, oversized packet is transmitted to the target, the stack proceeds to copy the data into the destination buffer without validating that the source length is less than or equal to the buffer capacity. This results in a classic linear heap or stack-based buffer overflow, depending on the specific memory architecture utilized for the receive queue.\nThe attack flow proceeds as follows: First, an attacker establishes a network connection to the target device using the EtherNet/IP protocol. Second, the attacker encapsulates a malicious, oversized Class 3 explicit-message request within the CIP frame. Third, the NetStaX stack parses the header but fails to perform sufficient input validation on the length field or the actual payload size. Fourth, the stack performs a memory copy operation (such as a memcpy or equivalent) into the statically or dynamically allocated receive buffer. Because the length exceeds the boundary, adjacent memory structures are overwritten.\nThe impact of this memory corruption includes the potential for overwriting return addresses or function pointers, which can redirect the execution flow to attacker-supplied shellcode or cause immediate corruption of critical state variables. Furthermore, if the overflow triggers an invalid memory access or exception, the stack enters a crash loop, resulting in a permanent denial-of-service condition. Because the protocol implementation does not generate a CIP error response upon encountering this overflow, the attacker benefits from a silent exploitation window, confirming success through the absence of communication from the target device rather than explicit error signaling.\nThis vulnerability affects all NetStaX EtherNet/IP Stack versions prior to v5.6.1. Authentication is not a prerequisite, as the stack processes these requests at the protocol layer, and the vulnerability is accessible to any remote entity capable of routing EtherNet/IP traffic to the vulnerable device."
}