CVE-2026-70388 — HIGH (8.3)

Vulnerability Description

SOEM version 2.0.0 and earlier contains vulnerabilities where a malicious device on the network can send specially crafted messages that cause the master to write data outside allocated memory boundaries. The software performs arithmetic on message length values without proper validation, allowing negative or extremely large values to bypass safety checks. This can corrupt memory and potentially allow an attacker to execute arbitrary code on the master system.

CVSS Score

8.3

HIGH

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H

Attack Vector

ADJACENT_NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

LOW

Integrity

HIGH

Availability

HIGH

Related Weaknesses (CWE)

CWE-195 CWE-191 CWE-787

References

https://rt-labs.com/wp-content/uploads/2026/10/RRTL-260921-01.pdf

FAQ

What is CVE-2026-70388?

CVE-2026-70388 is a vulnerability with a CVSS score of 8.3 (HIGH). SOEM version 2.0.0 and earlier contains vulnerabilities where a malicious device on the network can send specially crafted messages that cause the master to write data outside allocated memory boundar...

How severe is CVE-2026-70388?

CVE-2026-70388 has been rated HIGH with a CVSS base score of 8.3/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-70388?

Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.