Live › vulnerability › CVE-2026-82943
Go to dashboardSOEM, an EtherCAT master library, trusts length values in device responses without checking them against buffer sizes. A malicious device on the network can make the master read up to 64KB of its own memory.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 09:29 UTC. All times on this page are UTC.
Systems that build SOEM into an EtherCAT master and accept responses from devices on the bus. The exposure depends on whether a device on that bus could be malicious or compromised. Teams not using SOEM, or running it only with fully trusted devices on an isolated bus, can likely skip it.
No product ranges from the sources yet.
2.0.0 or earlier, for example by reading the version in the project's build files or vendored source2.0.0 once a fixed release is published; the sources do not name the fixed versionEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
SOEM version 2.0.0 and earlier contains vulnerabilities where a malicious device can send messages that cause the master to read data from memory locations beyond the intended buffer. The software uses length values from device responses without validating them against actual buffer sizes. An attacker can exploit this to extract up to 64KB of data from the master's memory.
This page as .md · .json · in your agent: get_signal("CVE-2026-82943")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.