CVE-2026-13592: Out-of-Bounds Write in liftoff-sr CIPster EtherNet IP Handler

Technical summary

The vulnerability resides in the EtherNet IP Message Handler component of liftoff-sr CIPster, specifically in the BufWriter::append function. An attacker can manipulate input to the message handler to trigger an out-of-bounds write condition, violating memory safety boundaries (CWE-787: Out-of-bounds Write; CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer). The flaw requires no authentication or user interaction; an unauthenticated attacker on the network can trigger it by crafting a malicious EtherNet IP packet. Because CIPster uses a rolling release model without traditional versioning, users must identify their deployment by commit hash and verify whether they have integrated the patch commit 3a0159ed43125dcd024a1965f0289cb186bae9ff or later.

Business impact

EtherNet IP is widely used in industrial control systems, manufacturing environments, and critical infrastructure for real-time communication. A remotely exploitable out-of-bounds write can disrupt operations by crashing CIPster services, corrupting protocol state, or potentially allowing attackers to execute arbitrary code with the privileges of the affected process. In manufacturing or industrial settings, this could lead to unplanned downtime, loss of visibility into critical systems, or lateral movement into connected infrastructure. Organizations relying on CIPster for device communication face operational risk until the patch is deployed.

Affected systems

The vulnerability affects liftoff-sr CIPster up to and including commit e8e9dba09bf56962807d3504b783ccdb6287f3e4. CIPster is an open-source implementation of EtherNet IP, used in embedded systems, industrial devices, and control applications. Any deployment using a vulnerable commit is at risk. Because CIPster follows continuous delivery with rolling releases, version numbers are not published; teams must track deployments by Git commit hash and cross-reference against the affected range and the patched commit.

Exploitability

This vulnerability is actively exploitable over the network with no authentication or user interaction required. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) reflects a network-accessible attack surface, low complexity, and impact on confidentiality, integrity, and availability. A public exploit is now available, significantly raising the likelihood of active attacks. The lack of access controls or authentication barriers means any network-adjacent attacker—or potentially any attacker on the internet if the device is internet-facing—can attempt exploitation.

Remediation

Deploy the patch commit 3a0159ed43125dcd024a1965f0289cb186bae9ff or any later commit that incorporates this fix. For rolling-release deployments, pull the latest main branch or update to a commit dated after July 1, 2026 (the modification date of this advisory) and rebuild/redeploy. If you cannot patch immediately, implement network segmentation to restrict access to EtherNet IP services, disable the service if not essential, or apply network-level filtering to limit which hosts can communicate with CIPster devices.

Patch guidance

Verify your current CIPster deployment commit using 'git log --oneline' or your build artifact metadata. Compare against the vulnerable range (up to e8e9dba) and confirm whether your commit is at or before that point. If so, merge or cherry-pick commit 3a0159ed43125dcd024a1965f0289cb186bae9ff into your branch, or pull the latest main branch if it already contains this patch. Rebuild and test the patched version in a staging environment, then proceed to production deployment. If using CIPster as a vendored library or integrated component, verify that your upstream has integrated the patch; if not, consider merging it directly or requesting a release from your vendor.

Detection guidance

Monitor network traffic for malformed or oversized EtherNet IP messages sent to CIPster ports (typically UDP 2222 or configured alternatives). Log and alert on EtherNet IP protocol violations, especially messages that trigger buffer boundary warnings or crashes. Implement application-level logging in CIPster to capture append operations that exceed expected buffer sizes. If possible, enable memory protection tools (e.g., AddressSanitizer during development/testing) to catch out-of-bounds writes before production. Monitor system logs for unexpected crashes or memory corruption events on hosts running CIPster services.

Why prioritize this

This vulnerability merits immediate attention due to: (1) a CVSS 3.1 score of 7.3 (HIGH severity) with impact on all three security pillars (confidentiality, integrity, availability); (2) network accessibility requiring no authentication; (3) public availability of an exploit, indicating active threat potential; (4) widespread use of EtherNet IP in industrial and critical infrastructure; and (5) potential for code execution via memory corruption. Even if immediate patching is constrained, network isolation should be implemented urgently.

Risk score, explained

The CVSS 3.1 score of 7.3 reflects: Attack Vector (Network) — the flaw is reachable remotely without special access; Attack Complexity (Low) — no special conditions are needed to trigger the vulnerability; Privileges Required (None) — no authentication is necessary; User Interaction (None) — exploitation is automatic upon receipt of a crafted message; and Scope (Unchanged) — impact is limited to the vulnerable component. The confidentiality, integrity, and availability impacts are all present (Low for each), accounting for the HIGH severity rating. The availability impact is particularly concerning in industrial contexts where CIPster crashes or service disruption is operationally damaging.

Frequently asked questions