A security flaw has been discovered in liftoff-sr CIPster 1802525be27d33e19a9a83c163e331a1d13b1892. The impacted element is the function CipAttribute::GetAttrData/CipAttribute::SetAttrData of the file ciptypes.h of the component Generic Attribute Logic. Performing a manipulation results in memory corruption. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. The patch is named e745d9d4a8ca3a13689066983a1269fe1e567674. It is suggested to install a patch to address this issue.

A memory corruption vulnerability has been identified in liftoff-sr CIPster at commit 1802525be27d33e19a9a83c163e331a1d13b1892. The flaw resides in the functions CipAttribute::GetAttrData and CipAttribute::SetAttrData within the ciptypes.h file under the Generic Attribute Logic component. An attacker can remotely exploit this vulnerability by manipulating input to trigger memory corruption. A public exploit is available, raising the risk of active exploitation in the wild. CIPster is an open-source implementation of the Common Industrial Protocol (CIP), commonly used in industrial and OT environments, making this a potentially critical infrastructure risk. A patch has been provided via commit e745d9d4a8ca3a13689066983a1269fe1e567674 on GitHub. Users are strongly advised to apply the patch immediately to mitigate exposure.