Description

Stack-based buffer overflow vulnerability exists in Remote I/O Coupler Unit (Server Type) CPSN-MCB271-*. Receiving a specially crafted request created and sent by a remote attacker may cause a denial-of-service (DoS) condition.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-14T07:17:20.370Z",
  "pubdate": "2026-09-14T07:17:20.370Z",
  "executiveSummary": "A critical stack-based buffer overflow vulnerability has been identified in the Remote I/O Coupler Unit (Server Type) CPSN-MCB271-* series.\nThis vulnerability stems from improper input validation when processing incoming network requests, allowing an unauthenticated remote attacker to trigger memory corruption.\nThe primary impact of successful exploitation is a Denial-of-Service (DoS) condition, which disrupts the availability of the I/O Coupler unit and associated industrial control processes.\nThe flaw resides in the device's request handling logic, which fails to adequately bound the size of incoming data packets against the allocated stack memory.\nBy sending a specially crafted request, an attacker can overwrite critical stack data, including return addresses, leading to a crash or unstable state.\nGiven that these devices are typically deployed within industrial automation environments, a DoS event may lead to significant operational downtime, requiring manual intervention to restore the device to a functional state.\nThere are no specific requirements for prior authentication; however, the attacker must have network connectivity to the affected device to transmit the malicious payload.",
  "technicalDetails": "The vulnerability is characterized as a classic stack-based buffer overflow within the request processing subsystem of the CPSN-MCB271-* series units.\nThe root cause is the usage of insecure memory copy functions or inadequate boundary checking when the device parses incoming protocol requests.\nWhen a remote attacker transmits a payload that exceeds the predetermined size of the allocated stack buffer, the extraneous data overflows into adjacent memory regions on the stack.\nThe attack flow begins with the attacker initiating a connection to the network-exposed management or data communication interface of the CPSN-MCB271 unit.\nThe attacker then crafts a malicious packet containing a payload designed to exceed the capacity of the target buffer. The device, upon receipt, attempts to process the payload without verifying that the input length corresponds to the buffer constraints.\nBy overwriting the stack frame, the attacker effectively corrupts the saved instruction pointer (Return Address). When the function completes, the CPU attempts to resume execution at the corrupted address, resulting in an immediate exception or segment violation that forces the device into a non-responsive state.\nBecause the overflow impacts the stack directly, the device's executive software fails to handle the memory violation gracefully, necessitating a hardware or software reset to clear the DoS condition.\nThe vulnerability is particularly dangerous as it is reachable over the network without requiring valid credentials. The lack of input sanitization acts as the primary vector, implying that the parsing routine does not implement modern exploit mitigations like stack canaries or address space layout randomization (ASLR) that would typically prevent simple crash-based exploitation.\nPost-exploitation impact is limited to system instability or service termination, effectively severing the communication link between the I/O Coupler and the host controller, which can stall automated processes and require a reboot of the hardware."
}