{"id":"CVE-2026-82357","state":"PUBLISHED","title":"RT-Labs AB C-Open CANopen NULL pointer dereference","description":"RT-Labs AB C-Open CANopen contains a NULL pointer dereference if the LSS protocol is used to configure the device. An object defined by the user application may not have all required subindexes for object 0x1018. An unauthenticated, remote attacker with access to the CAN bus, through a compromised node for instance, can initiate the LSS protocol on a device with a misconfigured identity object and potentially crash the device. Fixed in 1.1.1.","publishedAt":"2026-10-01T19:41:47.996Z","updatedAt":"2026-10-07T15:52:15.802Z","severity":{"score":7.1,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","source":"cisa-cg"},"assigner":"cisa-cg","products":["RT-Labs AB C-Open"],"affected":[{"vendor":"RT-Labs AB","product":"C-Open","defaultStatus":"affected","versions":[{"version":"0","status":"affected","lessThan":"1.1.1","versionType":"custom"},{"version":"1.1.1","status":"unaffected"}]}],"references":["https://rt-labs.com/wp-content/uploads/2026/09/RRTL-260929-01.pdf","https://github.com/rtlabs-com/c-open/releases/tag/public%2Fv1.1.1","https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-26-275-02.json","https://www.cve.org/CVERecord?id=CVE-2026-82357"],"weaknesses":["CWE-476"],"ingestedAt":"2026-10-29T20:13:15.269Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/82xxx/CVE-2026-82357.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-82357","state":"PUBLISHED","datePublished":"2026-10-01T19:41:47.996Z","dateUpdated":"2026-10-07T15:52:15.802Z","assignerShortName":"cisa-cg","assignerOrgId":"9119a7d8-5eab-497f-8521-727c672e3725","dateReserved":"2026-08-28T18:10:39.170Z"},"containers":{"cna":{"title":"RT-Labs AB C-Open CANopen NULL pointer dereference","descriptions":[{"lang":"en","value":"RT-Labs AB C-Open CANopen contains a NULL pointer dereference if the LSS protocol is used to configure the device. An object defined by the user application may not have all required subindexes for object 0x1018. An unauthenticated, remote attacker with access to the CAN bus, through a compromised node for instance, can initiate the LSS protocol on a device with a misconfigured identity object and potentially crash the device. Fixed in 1.1.1."}],"affected":[{"vendor":"RT-Labs AB","product":"C-Open","defaultStatus":"affected","versions":[{"version":"0","status":"affected","lessThan":"1.1.1","versionType":"custom"},{"version":"1.1.1","status":"unaffected"}]}],"references":[{"url":"https://rt-labs.com/wp-content/uploads/2026/09/RRTL-260929-01.pdf","name":"url","tags":["vendor-advisory"]},{"url":"https://github.com/rtlabs-com/c-open/releases/tag/public%2Fv1.1.1","name":"url","tags":["release-notes"]},{"url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-26-275-02.json","name":"url","tags":["third-party-advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-82357","name":"url","tags":["vdb-entry"]}],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"ADJACENT_NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}},{"cvssV4_0":{"version":"4.0","baseScore":7.1,"attackVector":"ADJACENT","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"other":{"type":"ssvc","content":{"timestamp":"2026-08-28T17:49:30.066195Z","id":"CVE-2026-82357","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-476","description":"CWE-476 NULL Pointer Dereference","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"cisa-cg","orgId":"9119a7d8-5eab-497f-8521-727c672e3725","dateUpdated":"2026-10-01T19:41:47.996Z"},"credits":[{"value":"f0rw4rd, quellsec.dev","lang":"en"}],"datePublic":"2026-09-21T00:00:00.000Z"},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-82357","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-07T15:10:23.406343Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-07T15:52:15.802Z"}}]}}}