{"id":"CVE-2026-82945","kind":"vulnerability","aliases":["CVE-2026-82945"],"related":[],"title":"SOEM: a malicious EtherCAT device can corrupt memory during configuration","description":"SOEM version 2.0.0 and earlier contains a vulnerability during device configuration where a malicious device can cause memory corruption. The software writes configuration data to a fixed-size array without checking if the array index exceeds its maximum size of EC_MAXFMMU entries. A device presenting more than EC_MAXFMMU configuration blocks can force writes beyond the array boundary, corrupting adjacent memory structures and potentially disrupting subsequent operations.","summary":"SOEM, an open-source EtherCAT master library, writes device configuration data into a fixed-size array without bounds checking. A malicious device that presents more than EC_MAXFMMU configuration blocks can overwrite adjacent memory and disrupt later operations.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["embedded","ethercat","industrial-control","package","robotics","soem"],"not_affected_if":["isolated-bus","newer-version","vetted-devices-only"],"how_to_check":"- Check the SOEM version in use: unknown exact command, the sources do not name a package manager or file\n- Search the project for `EC_MAXFMMU` and the device configuration code path to see if it is compiled in\n- Review whether the master talks to untrusted or third-party EtherCAT slave devices","fix":"- Upgrade SOEM past `2.0.0`; the sources do not name the fixed release, check the upstream SOEM repository\n- Until patched, restrict the EtherCAT network to trusted devices","status":"open","published_at":"2026-10-26T09:16:36+00:00","first_seen_at":"2026-10-26T09:29:16+00:00","triaged_at":"2026-10-26T09:30:53+00:00","updated_at":"2026-10-26T09:30:53+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-26T09:30:53Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade SOEM past `2.0.0`; the sources do not name the fixed release, check the upstream SOEM repository\n- Until patched, restrict the EtherCAT network to trusted devices","reach":"local","title":"SOEM: a malicious EtherCAT device can corrupt memory during configuration","impact":"medium","summary":"SOEM, an open-source EtherCAT master library, writes device configuration data into a fixed-size array without bounds checking. A malicious device that presents more than EC_MAXFMMU configuration blocks can overwrite adjacent memory and disrupt later operations.","category":"package","nicknames":[],"who_cares":["soem","ethercat","industrial-control","embedded","robotics"],"confidence":0.6,"needs_auth":"no","worst_case":"memory corruption in the master process, possible crash or disruption","analyst_note":"Find the fixed SOEM release and the upstream advisory or commit that adds the bounds check; the NVD entry lacks version-fix details and reach beyond the local bus is unclear.","how_to_check":"- Check the SOEM version in use: unknown exact command, the sources do not name a package manager or file\n- Search the project for `EC_MAXFMMU` and the device configuration code path to see if it is compiled in\n- Review whether the master talks to untrusted or third-party EtherCAT slave devices","needs_analyst":true,"not_affected_if":["vetted-devices-only","isolated-bus","newer-version"],"who_is_affected":"Teams that build or run systems using SOEM 2.0.0 or earlier as an EtherCAT master, typically industrial automation, robotics and embedded controllers. Exposure depends on whether the master accepts configuration from devices that could be malicious or compromised; systems that only talk to vetted, fixed hardware on an isolated bus have lower risk.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000672,"input_tokens":3370,"output_tokens":671,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-82945':13A,16A '2.0.0':67C 'adjac':59B,126C 'array':42B,94C,99C,123C 'beyond':121C 'block':56B,117C 'bound':44B 'boundari':124C 'caus':81C 'check':45B,96C 'configur':10A,35B,55B,75C,87C,116C 'contain':70C 'control':21B 'corrupt':7A,83C,125C 'cve':11A,14A 'data':36B,88C 'devic':5A,34B,48B,74C,79C,110C 'disrupt':62B,131C 'earlier':69C 'ec':53B,106C,114C 'embed':17B 'entri':108C 'ethercat':4A,18B,30B 'exceed':101C 'fix':40B,92C 'fixed-s':39B,91C 'forc':119C 'index':100C 'industri':20B 'industrial-control':19B 'later':63B 'librari':32B 'malici':3A,47B,78C 'master':31B 'maxfmmu':54B,107C,115C 'maximum':103C 'memori':8A,60B,82C,127C 'open':28B 'open-sourc':27B 'oper':64B,133C 'overwrit':58B 'packag':22B 'potenti':130C 'present':50B,111C 'robot':23B 'size':41B,93C,104C 'soem':1A,24B,25B,65C 'softwar':85C 'sourc':29B 'structur':128C 'subsequ':132C 'version':66C 'vulner':72C 'without':43B,95C 'write':33B,86C,120C","nicknames":[],"mitigations":[],"who_affected":"Teams that build or run systems using SOEM 2.0.0 or earlier as an EtherCAT master, typically industrial automation, robotics and embedded controllers. Exposure depends on whether the master accepts configuration from devices that could be malicious or compromised; systems that only talk to vetted, fixed hardware on an isolated bus have lower risk.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T09:16:36+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-82945","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82945","severity":null,"published_at":"2026-10-26T09:16:36+00:00","modified_at":"2026-10-26T09:16:36+00:00","first_seen_at":"2026-10-26T09:29:16+00:00","fetched_at":"2026-10-26T09:29:16+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}