CVE-2026-82357

MediumCVSS 6.5/10Last modified Oct 7, 2026

Description

RT-Labs AB C-Open CANopen contains a NULL pointer dereference if the LSS protocol is used to configure the device. An object defined by the user application may not have all required subindexes for object 0x1018. An unauthenticated, remote attacker with access to the CAN bus, through a compromised node for instance, can initiate the LSS protocol on a device with a misconfigured identity object and potentially crash the device. Fixed in 1.1.1.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-476

Affected software

No affected versions have been published.

Timeline

Published: Oct 1, 2026
Last modified: Oct 7, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-823586.5RT-Labs AB C-Open CANopen contains a write protection bypass in the SDO (Service Data Object) server implementation 'src/co_sdo_server.c' th CVE-2026-82364.3Concrete CMS 9.5.0 and below is vulnerable to IDOR combined with a missing authentication gate. The endpoint /ccm/system/dialogs/file/usage/CVE-2026-823644.2A security vulnerability has been detected in macrozheng mall up to 1.0.3. This impacts an unknown function of the file /order/submit of the CVE-2026-823672.3Exposure of Data Element to Wrong Session vulnerability in ash-project ash_graphql can deliver one subscription's resolved records to a diff CVE-2026-823688.7Insecure access controls on internal service ports in Brocade SANnav versions before 3.0.1a allow local, non-administrative host users to co CVE-2026-823698.6Insufficient input sanitization of shell metacharacters in the Brocade SANnav CLI scripting component permits authenticated users to break o CVE-2026-82375.3Concrete CMS 9.5.0 and below is vulnerable to IDOR. The `/ccm/frontend/conversations/message_detail` endpoint returns the full content of an CVE-2026-823708.6Unauthenticated remote command injection in the Brocade SANnav orchestrator HTTP service permits network-adjacent attackers to execute arbit CVE-2026-823718.5Plaintext exposure of sensitive authentication data in Brocade SANnav discovery service log files enables individuals with file read access CVE-2026-823728.5Improper handling of sensitive data during IPsec policy creation and modification in Brocade SANnav versions before 3.0.1a results in pre-sh CVE-2026-823757.4Server-Side Request Forgery (SSRF) in Apache Roller 6.1.5 allows an authenticated user with entry-editing rights on a weblog to cause outbou CVE-2026-823767.7Improper Restriction of XML External Entity Reference in Apache Roller 6.1.5 allows a user with entry-editing rights on a weblog to cause th