CVE-2026-82943Medium· 6.5▾ SunlitSOEM version 2.0.0 and earlier contains vulnerabilities where a malicious device can send messages that cause the master to read data from memory locations beyond the intended buffer. The software uses length values from device responses…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Oct 26.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.2%
SOEM version 2.0.0 and earlier contains vulnerabilities where a malicious device can send messages that cause the master to read data from memory locations beyond the intended buffer. The software uses length values from device responses without validating them against actual buffer sizes. An attacker can exploit this to extract up to 64KB of data from the master's memory.
SOEM < 2.0.1Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-70388High· 8.3Memory Corruption via Integer Underflow in Message Length Validation
CVE-2026-82947High· 7.1Multiple Out-of-Bounds Reads in Frame Processing
CVE-2026-82944High· 8.8Buffer Overflow in CoE SDO Upload Multi-Segment Data Transfers
CVE-2026-82945Medium· 6.5Memory Corruption via FMMU Configuration Table Overflow
CVE-2026-82946Medium· 6.5Null Pointer Dereference in Mailbox Error Handling
CVE-2026-82357Medium· 6.5RT-Labs AB C-Open CANopen contains a NULL pointer dereference if the LSS protocol is used to configure the device