CVE-2026-13592: CIPster Buffer Overflow Vulnerability

CVE-2026-13592 Overview

CVE-2026-13592 is an out-of-bounds write vulnerability in the BufWriter::append function of the EtherNet/IP Message Handler component in liftoff-sr CIPster. The flaw affects commits up to e8e9dba09bf56962807d3504b783ccdb6287f3e4 and is classified under [CWE-119] (Improper Restriction of Operations within the Bounds of a Memory Buffer). Remote exploitation is possible over the network without authentication or user interaction. A public proof-of-concept exists, increasing the likelihood of opportunistic attempts against exposed industrial systems. CIPster follows a rolling release model, so no discrete version identifiers are available; the fix is delivered in patch commit 3a0159ed43125dcd024a1965f0289cb186bae9ff.

Critical Impact
Remote unauthenticated attackers can trigger memory corruption in industrial EtherNet/IP endpoints running unpatched CIPster builds.

Affected Products

liftoff-sr CIPster (rolling release) up to commit e8e9dba09bf56962807d3504b783ccdb6287f3e4
CIPster EtherNet/IP Message Handler component
Downstream projects and appliances embedding vulnerable CIPster builds

Discovery Timeline

2026-06-29 - CVE CVE-2026-13592 published to NVD
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-13592

Vulnerability Analysis

CIPster implements the Common Industrial Protocol (CIP) over EtherNet/IP for industrial control communications. The BufWriter::append routine writes CIP attribute data into a serialization buffer during message handling. Manipulating request fields causes append to write beyond the allocated buffer, corrupting adjacent memory. Because the primitive is reachable from remote, unauthenticated EtherNet/IP traffic, any device exposing the CIPster message handler on a reachable network can be targeted. Consequences range from process crashes and denial of service on the industrial endpoint to potential code execution paths where attacker-controlled bytes overwrite structured state such as attribute descriptors or function pointers stored near the buffer.

Root Cause

The root cause is missing size validation between the writer position and destination buffer bounds when appending attribute payloads. CIPster previously used untyped void*/offset attribute inserters that supplied raw memory offsets and sizes without compile-time type binding. Mismatches between declared attribute lengths and the actual destination member size allowed BufWriter::append to write past the object.

Attack Vector

An attacker sends a crafted CIP message to the EtherNet/IP service on the target device. The malformed request drives the message handler through the attribute serialization path, invoking BufWriter::append with a length that exceeds the target buffer. A public proof-of-concept packet capture is available in the referenced GitHub PoC File.

text

// Patch excerpt: cipassembly.cc — replace untyped inserters with typed ones
     AttributeInsert( _I, 3, get_assembly_data_attr, false, set_assembly_data_attr,
         memb_offs(byte_array),  true, kCipByteArray);

-    // Attribute 4: is no. of bytes in Attribute 3
-    AttributeInsert( _I, 4, kCipByteArrayLength, memb_offs(byte_array), true, false );
+    // Attribute 4: is no. of bytes in Attribute 3 (read-only here)
+    AttributeInsertByteArrayLength( _I, 4, &AssemblyInstance::byte_array, true, false );
 }

Source: GitHub Commit Details

text

// Patch excerpt: cipethernetlink.cc — typed member-pointer inserters
-    AttributeInsert( _I, 1, kCipUdint,  memb_offs(interface_speed) );
-    AttributeInsert( _I, 2, kCipDword,  memb_offs(interface_flags) );
-    AttributeInsert( _I, 3, kCip6Usint, memb_offs(physical_address) );
+    AttributeInsertUdint(  _I, 1, &CipEthernetLinkInstance::interface_speed );
+    AttributeInsertDword(  _I, 2, &CipEthernetLinkInstance::interface_flags );
+    AttributeInsert6Usint( _I, 3, &CipEthernetLinkInstance::physical_address );

Source: GitHub Commit Details

The fix introduces compile-time-typed AttributeInsert* overloads that bind attribute size to the actual member type, eliminating the size/type mismatch that fed BufWriter::append.

Detection Methods for CVE-2026-13592

Indicators of Compromise

Unexpected termination or restart of processes hosting the CIPster EtherNet/IP handler on port TCP/44818 or UDP/2222.
Malformed CIP Common Packet Format messages containing oversized attribute values addressed to Assembly (0x04) or Ethernet Link (0xF6) objects.
Inbound EtherNet/IP traffic from unexpected external or IT-network sources toward OT segments.

Detection Strategies

Deploy protocol-aware intrusion detection with CIP/EtherNet/IP dissectors to flag attribute writes whose declared length exceeds the target attribute's data type size.
Correlate crash telemetry from industrial devices with preceding EtherNet/IP sessions to surface exploitation attempts against BufWriter::append.
Compare running CIPster builds against commit 3a0159ed43125dcd024a1965f0289cb186bae9ff in software inventory to identify unpatched assets.

Monitoring Recommendations

Enable full packet capture on OT boundary segments carrying EtherNet/IP for retrospective analysis of malformed CIP requests.
Monitor for repeated connection resets or handler restarts on CIP-enabled devices as a signal of exploitation attempts.
Track new inbound flows to TCP/44818 and UDP/2222 from hosts outside the approved control-system allow list.

How to Mitigate CVE-2026-13592

Immediate Actions Required

Rebuild and redeploy CIPster from commit 3a0159ed43125dcd024a1965f0289cb186bae9ff or later across all affected devices and firmware images.
Restrict EtherNet/IP traffic (TCP/44818, UDP/2222) to authorized engineering workstations and controllers via firewall or ACL.
Segment OT networks from IT and remote-access zones to remove unauthenticated network reachability to CIPster endpoints.
Review software bills of materials for downstream products embedding CIPster and coordinate patch delivery with vendors.

Patch Information

The upstream fix is patch commit 3a0159ed43125dcd024a1965f0289cb186bae9ff, which introduces typed AttributeInsert* inserters and deprecates the vulnerable void*/offset overloads. See the GitHub Commit Details and GitHub Issue Discussion for context. Because CIPster is a rolling-release library, downstream integrators must rebuild firmware or applications that statically link CIPster.

Workarounds

Block or filter untrusted CIP messages at an industrial firewall or deep-packet-inspection gateway until the patched build is deployed.
Disable exposed EtherNet/IP services on devices that do not require CIP connectivity in the current operational context.
Enforce allow-list source addressing for CIP originators on affected controllers where the platform supports it.

bash

# Example iptables rule: restrict EtherNet/IP to a trusted engineering subnet
iptables -A INPUT -p tcp --dport 44818 -s 10.20.30.0/24 -j ACCEPT
iptables -A INPUT -p udp --dport 2222  -s 10.20.30.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 44818 -j DROP
iptables -A INPUT -p udp --dport 2222  -j DROP