{"id":"CVE-2026-82946","kind":"vulnerability","aliases":["CVE-2026-82946"],"related":[],"title":"SOEM: malicious EtherCAT device can crash master via cleared pointer","description":"SOEM version 2.0.0 and earlier contains a vulnerability where a malicious device can crash the master system. When the software receives an error response, it clears an internal pointer but continues processing. If another message arrives before timeout, the software attempts to use the cleared pointer, causing a crash. An attacker can trigger this with a simple sequence of two messages.","summary":"SOEM, an open-source EtherCAT master library, clears an internal pointer when it receives an error response but keeps processing. If a second message arrives before timeout, it dereferences the cleared pointer and crashes. An attacker controlling a device on the bus can crash the master with two messages.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["embedded","ethercat","industrial-control","package","soem"],"not_affected_if":["not-using-soem","trusted-devices-only"],"how_to_check":"- Check whether the project uses SOEM by searching dependencies and sources for `ec_init` or `soem` (unknown for exact version lookup from the sources)\n- Confirm the SOEM version in use; the sources say 2.0.0 and earlier are affected","fix":"- Upgrade SOEM past `2.0.0` to a release that includes the fix (the fixed version is unknown from the sources)\n- Until patched, restrict which devices can attach to the EtherCAT bus (unknown whether this is sufficient)","status":"open","published_at":"2026-10-26T09:16:36+00:00","first_seen_at":"2026-10-26T09:29:16+00:00","triaged_at":"2026-10-26T09:30:53+00:00","updated_at":"2026-10-26T09:30:53+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-26T09:30:53Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade SOEM past `2.0.0` to a release that includes the fix (the fixed version is unknown from the sources)\n- Until patched, restrict which devices can attach to the EtherCAT bus (unknown whether this is sufficient)","reach":"network","title":"SOEM: malicious EtherCAT device can crash master via cleared pointer","impact":"medium","summary":"SOEM, an open-source EtherCAT master library, clears an internal pointer when it receives an error response but keeps processing. If a second message arrives before timeout, it dereferences the cleared pointer and crashes. An attacker controlling a device on the bus can crash the master with two messages.","category":"package","nicknames":[],"who_cares":["soem","ethercat","industrial-control","embedded"],"confidence":0.6,"needs_auth":"no","worst_case":"Master process crashes, interrupting EtherCAT control and communication.","analyst_note":"Find the fixed SOEM version and the upstream fix commit from the NVD entry references; sources give no patched version.","how_to_check":"- Check whether the project uses SOEM by searching dependencies and sources for `ec_init` or `soem` (unknown for exact version lookup from the sources)\n- Confirm the SOEM version in use; the sources say 2.0.0 and earlier are affected","needs_analyst":true,"not_affected_if":["not-using-soem","trusted-devices-only"],"who_is_affected":"Systems running SOEM 2.0.0 or earlier as an EtherCAT master, where a device on the fieldbus can send responses. The sources do not describe a default configuration that changes exposure. Teams not using SOEM, or running it on a bus with only trusted devices, face lower risk.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000648,"input_tokens":3330,"output_tokens":630,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-82946':13A,16A '2.0.0':76C 'anoth':107C 'arriv':49B,109C 'attack':60B,124C 'attempt':114C 'bus':66B 'caus':120C 'clear':9A,32B,55B,99C,118C 'contain':79C 'continu':104C 'control':21B,61B 'crash':6A,58B,68B,87C,122C 'cve':11A,14A 'derefer':53B 'devic':4A,63B,85C 'earlier':78C 'embed':17B 'error':40B,96C 'ethercat':3A,18B,29B 'industri':20B 'industrial-control':19B 'intern':34B,101C 'keep':43B 'librari':31B 'malici':2A,84C 'master':7A,30B,70B,89C 'messag':48B,73B,108C,134C 'open':27B 'open-sourc':26B 'packag':22B 'pointer':10A,35B,56B,102C,119C 'process':44B,105C 'receiv':38B,94C 'respons':41B,97C 'second':47B 'sequenc':131C 'simpl':130C 'soem':1A,23B,24B,74C 'softwar':93C,113C 'sourc':28B 'system':90C 'timeout':51B,111C 'trigger':126C 'two':72B,133C 'use':116C 'version':75C 'via':8A 'vulner':81C","nicknames":[],"mitigations":[],"who_affected":"Systems running SOEM 2.0.0 or earlier as an EtherCAT master, where a device on the fieldbus can send responses. The sources do not describe a default configuration that changes exposure. Teams not using SOEM, or running it on a bus with only trusted devices, face lower risk.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T09:16:36+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-82946","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82946","severity":null,"published_at":"2026-10-26T09:16:36+00:00","modified_at":"2026-10-26T09:16:36+00:00","first_seen_at":"2026-10-26T09:29:16+00:00","fetched_at":"2026-10-26T09:29:16+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}