CVE-2022-43606 Null dereference in OpENer

High 7.5 Published 16 Mar 2023 Updated 3 Aug 2024

An attacker can crash the OpENer EtherNet/IP server by sending crafted requests that trigger a null pointer dereference.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2022-43606?

CVE-2022-43606 is a high-severity vulnerability in EIP Stack Group OpENer, published on 16 Mar 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A use-of-uninitialized-pointer vulnerability exists in the Forward Open connection_management_entry functionality of EIP Stack Group OpENer development commit 58ee13c. A specially-crafted EtherNet/IP request can lead to use of a null pointer, causing the server to crash. An attacker can send a series of EtherNet/IP requests to trigger this vulnerability.

Weakness: CWE-824

Which versions are affected by CVE-2022-43606?

It affects 1 product.

Products include Opener Project Opener.

How do I fix CVE-2022-43606?

No fix has been published for CVE-2022-43606 yet. Limit exposure of the affected software until one is available.

Is CVE-2022-43606 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-43606 exists.

Sources

Also known as GHSA-xh44-7m8v-gqg4.