CVE-2026-13592

{
  "id": "CVE-2026-13592",
  "sourceIdentifier": "[email protected]",
  "published": "2026-06-29T18:16:37.103",
  "lastModified": "2026-10-25T21:10:00.770",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability was detected in liftoff-sr CIPster up to e8e9dba09bf56962807d3504b783ccdb6287f3e4. Affected by this issue is the function BufWriter::append of the component EtherNet IP Message Handler. Performing a manipulation results in out-of-bounds write. Remote exploitation of the attack is possible. The exploit is now public and may be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The patch is named 3a0159ed43125dcd024a1965f0289cb186bae9ff. To fix this issue, it is recommended to deploy a patch."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad fue detectada en liftoff-sr CIPster hasta e8e9dba09bf56962807d3504b783ccdb6287f3e4. Afectada por este problema es la función BufWriter::append del componente Gestor de Mensajes EtherNet IP. Realizar una manipulación resulta en escritura fuera de límites. La explotación remota del ataque es posible. El exploit es ahora público y puede ser usado. Este producto sigue un enfoque de lanzamiento continuo para la entrega continua, por lo tanto, los detalles de la versión para las versiones afectadas o actualizadas no se proporcionan. El parche se llama 3a0159ed43125dcd024a1965f0289cb186bae9ff. Para solucionar este problema, se recomienda desplegar un parche."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "liftoff-sr",
          "product": "CIPster",
          "cpes": [
            "cpe:2.3:a:liftoff-sr:cipster:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "EtherNet IP Message Handler"
          ],
          "versions": [
            {
              "version": "e8e9dba09bf56962807d3504b783ccdb6287f3e4",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 5.5,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "vulnConfidentialityImpact": "LOW",
          "vulnIntegrityImpact": "LOW",
          "vulnAvailabilityImpact": "LOW",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "subAvailabilityImpact": "NONE",
          "exploitMaturity": "PROOF_OF_CONCEPT",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
          "baseScore": 7.3,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "LOW"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.4
      }
    ],
    "cvssMetricV2": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "2.0",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "accessComplexity": "LOW",
          "authentication": "NONE",
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "availabilityImpact": "PARTIAL"
        },
        "baseSeverity": "HIGH",
        "exploitabilityScore": 10.0,
        "impactScore": 6.4,
        "acInsufInfo": false,
        "obtainAllPrivilege": false,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-01T14:08:09.537127Z",
          "id": "CVE-2026-13592",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-119"
        },
        {
          "lang": "en",
          "value": "CWE-787"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/liftoff-sr/CIPster/",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/liftoff-sr/CIPster/commit/3a0159ed43125dcd024a1965f0289cb186bae9ff",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/liftoff-sr/CIPster/issues/48",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/liftoff-sr/CIPster/issues/48#issuecomment-4596727632",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/user-attachments/files/28452971/poc.zip",
      "source": "[email protected]"
    },
    {
      "url": "https://vuldb.com/cve/CVE-2026-13592",
      "source": "[email protected]"
    },
    {
      "url": "https://vuldb.com/submit/844566",
      "source": "[email protected]"
    },
    {
      "url": "https://vuldb.com/vuln/374596",
      "source": "[email protected]"
    },
    {
      "url": "https://vuldb.com/vuln/374596/cti",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/liftoff-sr/CIPster/issues/48",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}