{"id":"CVE-2026-82943","kind":"vulnerability","aliases":["CVE-2026-82943"],"related":[],"title":"SOEM: malicious device responses let the master read past buffers","description":"SOEM version 2.0.0 and earlier contains vulnerabilities where a malicious device can send messages that cause the master to read data from memory locations beyond the intended buffer. The software uses length values from device responses without validating them against actual buffer sizes. An attacker can exploit this to extract up to 64KB of data from the master's memory.","summary":"SOEM, an EtherCAT master library, trusts length values in device responses without checking them against buffer sizes. A malicious device on the network can make the master read up to 64KB of its own memory.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["embedded","ethercat","industrial-automation","infrastructure","soem"],"not_affected_if":["isolated-trusted-bus","not-using-soem"],"how_to_check":"- Check whether the SOEM version in use is `2.0.0` or earlier, for example by reading the version in the project's build files or vendored source\n- Check whether the master runs on a network segment where untrusted or rogue EtherCAT devices can connect","fix":"- Upgrade SOEM past `2.0.0` once a fixed release is published; the sources do not name the fixed version\n- Until then, keep untrusted devices off the EtherCAT network segment","status":"open","published_at":"2026-10-26T09:16:36+00:00","first_seen_at":"2026-10-26T09:29:16+00:00","triaged_at":"2026-10-26T09:30:56+00:00","updated_at":"2026-10-26T09:30:56+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-26T09:30:56Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade SOEM past `2.0.0` once a fixed release is published; the sources do not name the fixed version\n- Until then, keep untrusted devices off the EtherCAT network segment","reach":"local","title":"SOEM: malicious device responses let the master read past buffers","impact":"medium","summary":"SOEM, an EtherCAT master library, trusts length values in device responses without checking them against buffer sizes. A malicious device on the network can make the master read up to 64KB of its own memory.","category":"infrastructure","nicknames":[],"who_cares":["soem","ethercat","industrial-automation","embedded"],"confidence":0.6,"needs_auth":"no","worst_case":"master process leaks up to 64KB of its memory","analyst_note":"Find the fixed SOEM version and the vendor advisory on the NVD page; the sources do not say which release fixes it or whether the network reach is local-only.","how_to_check":"- Check whether the SOEM version in use is `2.0.0` or earlier, for example by reading the version in the project's build files or vendored source\n- Check whether the master runs on a network segment where untrusted or rogue EtherCAT devices can connect","needs_analyst":true,"not_affected_if":["not-using-soem","isolated-trusted-bus"],"who_is_affected":"Systems that build SOEM into an EtherCAT master and accept responses from devices on the bus. The exposure depends on whether a device on that bus could be malicious or compromised. Teams not using SOEM, or running it only with fully trusted devices on an isolated bus, can likely skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000623,"input_tokens":3329,"output_tokens":580,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-82943':13A,16A '2.0.0':61C '64kb':54B,111C 'actual':99C 'attack':103C 'autom':21B 'beyond':83C 'buffer':10A,39B,86C,100C 'caus':74C 'check':36B 'contain':64C 'cve':11A,14A 'data':79C,113C 'devic':3A,33B,43B,69C,93C 'earlier':63C 'embed':17B 'ethercat':18B,26B 'exploit':105C 'extract':108C 'industri':20B 'industrial-autom':19B 'infrastructur':22B 'intend':85C 'length':30B,90C 'let':5A 'librari':28B 'locat':82C 'make':48B 'malici':2A,42B,68C 'master':7A,27B,50B,76C,116C 'memori':58B,81C,118C 'messag':72C 'network':46B 'past':9A 'read':8A,51B,78C 'respons':4A,34B,94C 'send':71C 'size':40B,101C 'soem':1A,23B,24B,59C 'softwar':88C 'trust':29B 'use':89C 'valid':96C 'valu':31B,91C 'version':60C 'vulner':65C 'without':35B,95C","nicknames":[],"mitigations":[],"who_affected":"Systems that build SOEM into an EtherCAT master and accept responses from devices on the bus. The exposure depends on whether a device on that bus could be malicious or compromised. Teams not using SOEM, or running it only with fully trusted devices on an isolated bus, can likely skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T09:16:36+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-82943","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82943","severity":null,"published_at":"2026-10-26T09:16:36+00:00","modified_at":"2026-10-26T09:16:36+00:00","first_seen_at":"2026-10-26T09:29:16+00:00","fetched_at":"2026-10-26T09:29:16+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}