CVE-2026-82946Medium· 6.5▾ SunlitSOEM version 2.0.0 and earlier contains a vulnerability where a malicious device can crash the master system. When the software receives an error response, it clears an internal pointer but continues processing. If another message arrive…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
SOEM version 2.0.0 and earlier contains a vulnerability where a malicious device can crash the master system. When the software receives an error response, it clears an internal pointer but continues processing. If another message arrives before timeout, the software attempts to use the cleared pointer, causing a crash. An attacker can trigger this with a simple sequence of two messages.
SOEM < 2.0.1Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-70388High· 8.3Memory Corruption via Integer Underflow in Message Length Validation
CVE-2026-82943Medium· 6.5Out-of-Bounds Read via Unchecked Length Values
CVE-2026-82944High· 8.8Buffer Overflow in CoE SDO Upload Multi-Segment Data Transfers
CVE-2026-82945Medium· 6.5Memory Corruption via FMMU Configuration Table Overflow
CVE-2026-82947High· 7.1Multiple Out-of-Bounds Reads in Frame Processing
CVE-2026-82357Medium· 6.5RT-Labs AB C-Open CANopen contains a NULL pointer dereference if the LSS protocol is used to configure the device