{
  "document": {
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "lang": "en-US",
    "publisher": {
      "category": "coordinator",
      "contact_details": "https://www.cisa.gov/report",
      "issuing_authority": "CISA",
      "name": "CISA",
      "namespace": "https://www.cisa.gov/"
    },
    "title": "C-Open CANopen stack multiple vulnerabilities",
    "tracking": {
      "current_release_date": "2026-10-01T18:47:46Z",
      "generator": {
        "engine": {
          "name": "VINCE-NT",
          "version": "1.15.0+build.129"
        }
      },
      "id": "VA-26-275-02",
      "initial_release_date": "2026-10-01T18:47:46Z",
      "status": "final",
      "version": "1.0.0",
      "revision_history": [
        {
          "number": "1.0.0",
          "summary": "Initial publication",
          "date": "2026-10-01T18:47:46Z"
        }
      ]
    },
    "distribution": {
      "tlp": {
        "label": "WHITE"
      }
    },
    "notes": [
      {
        "text": "All information products included in [https://github.com/cisagov/CSAF/tree/develop/csaf_files/IT/white](https://github.com/cisagov/CSAF/tree/develop/csaf_files/IT/white) are provided \\\"as is\\\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see [https://us-cert.cisa.gov/tlp/](https://us-cert.cisa.gov/tlp/).",
        "title": "Legal Notice",
        "category": "legal_disclaimer"
      },
      {
        "text": "Worldwide",
        "title": "Countries and Areas Deployed",
        "category": "other"
      },
      {
        "text": "Information Technology",
        "title": "Critical Infrastructure Sectors",
        "category": "other"
      },
      {
        "text": "RT-Labs AB C-Open CANopen contains a NULL pointer dereference and a write protection bypass vulnerability. These vulnerabilities can potentially crash the device or allow any CANopen node to overwrite read-only OD entries using two SDO frames.",
        "title": "Risk Evaluation",
        "category": "summary"
      },
      {
        "text": "Fixed in 1.1.1.",
        "title": "Recommended Practices",
        "category": "general"
      },
      {
        "text": "United States",
        "title": "Company Headquarters Location",
        "category": "other"
      }
    ],
    "references": [
      {
        "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-26-275-02.json",
        "summary": "Vulnerability Advisory VA-26-275-02 CSAF",
        "category": "self"
      }
    ]
  },
  "product_tree": {
    "branches": [
      {
        "category": "vendor",
        "name": "RT-Labs AB",
        "branches": [
          {
            "category": "product_name",
            "name": "C-Open",
            "branches": [
              {
                "category": "product_version_range",
                "name": "<1.1.1",
                "product": {
                  "name": "RT-Labs AB C-Open <1.1.1",
                  "product_id": "CSAFPID-0001"
                }
              },
              {
                "category": "product_version",
                "name": "1.1.1",
                "product": {
                  "name": "RT-Labs AB C-Open 1.1.1",
                  "product_id": "CSAFPID-0002"
                }
              }
            ]
          },
          {
            "category": "product_name",
            "name": "C-Open",
            "branches": [
              {
                "category": "product_version_range",
                "name": "<1.1.1",
                "product": {
                  "name": "RT-Labs AB C-Open <1.1.1",
                  "product_id": "CSAFPID-0003"
                }
              },
              {
                "category": "product_version",
                "name": "1.1.1",
                "product": {
                  "name": "RT-Labs AB C-Open 1.1.1",
                  "product_id": "CSAFPID-0004"
                }
              }
            ]
          }
        ]
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-82357",
      "cwe": {
        "id": "CWE-476",
        "name": "NULL Pointer Dereference"
      },
      "notes": [
        {
          "category": "summary",
          "text": "RT-Labs AB C-Open CANopen contains a NULL pointer dereference if the LSS protocol is used to configure the device. An object defined by the user application may not have all required subindexes for object 0x1018. An unauthenticated, remote attacker with access to the CAN bus, through a compromised node for instance, can initiate the LSS protocol on a device with a misconfigured identity object and potentially crash the device. Fixed in 1.1.1.",
          "title": "Description"
        },
        {
          "category": "details",
          "title": "SSVC",
          "text": "SSVCv2/E:N/A:N/T:P/2026-08-28T17:49:30Z/"
        }
      ],
      "title": "RT-Labs AB C-Open CANopen NULL pointer dereference",
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ],
        "fixed": [
          "CSAFPID-0002"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "rt-labs.com",
          "url": "https://rt-labs.com/wp-content/uploads/2026/09/RRTL-260929-01.pdf"
        },
        {
          "category": "external",
          "summary": "github.com",
          "url": "https://github.com/rtlabs-com/c-open/releases/tag/public%2Fv1.1.1"
        },
        {
          "category": "external",
          "summary": "VA-26-275-02 CSAF",
          "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-26-275-02.json"
        },
        {
          "category": "external",
          "summary": "CVE-2026-82357",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-82357"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Fixed in 1.1.1.",
          "url": "https://rt-labs.com/wp-content/uploads/2026/09/RRTL-260929-01.pdf",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "date": "2026-09-21T00:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "Fixed in 1.1.1.",
          "url": "https://rt-labs.com/wp-content/uploads/2026/09/RRTL-260929-01.pdf",
          "product_ids": [
            "CSAFPID-0002"
          ],
          "date": "2026-09-21T00:00:00Z"
        }
      ],
      "acknowledgments": [
        {
          "organization": "quellsec.dev",
          "names": [
            " f0rw4rd"
          ]
        }
      ],
      "release_date": "2026-09-21T00:00:00Z"
    },
    {
      "cve": "CVE-2026-82358",
      "cwe": {
        "id": "CWE-863",
        "name": "Incorrect Authorization"
      },
      "notes": [
        {
          "category": "summary",
          "text": "RT-Labs AB C-Open CANopen contains a write protection bypass in the SDO (Service Data Object) server implementation 'src/co_sdo_server.c' that fails to properly validate write permissions when processing download-segment frames. An unauthenticated attacker on the CAN bus can initiate an SDO upload for a read-only Object Dictionary (OD) entry, which sets a data pointer to the read-only object, then send download-segment frames to write to that memory location. The download-segment handler does not verify that a download session is active, allowing any CANopen node to overwrite read-only OD entries using two SDO frames. Note that CANopen protocol operates over CAN bus and does not provide built-in authentication mechanisms. Fixed in 1.1.1.",
          "title": "Description"
        },
        {
          "category": "details",
          "title": "SSVC",
          "text": "SSVCv2/E:N/A:N/T:P/2026-08-28T18:03:52Z/"
        }
      ],
      "title": "RT-Labs AB C-Open CANopen SDO Server Write Protection Bypass",
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ],
        "fixed": [
          "CSAFPID-0002"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "rt-labs.com",
          "url": "https://rt-labs.com/wp-content/uploads/2026/09/RRTL-260929-01.pdf"
        },
        {
          "category": "external",
          "summary": "github.com",
          "url": "https://github.com/rtlabs-com/c-open/releases/tag/public%2Fv1.1.1"
        },
        {
          "category": "external",
          "summary": "VA-26-275-02 CSAF",
          "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-26-275-02.json"
        },
        {
          "category": "external",
          "summary": "CVE-2026-82358",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-82358"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Fixed in 1.1.1.",
          "url": "https://rt-labs.com/wp-content/uploads/2026/09/RRTL-260929-01.pdf",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "date": "2026-09-21T00:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "Fixed in 1.1.1.",
          "url": "https://rt-labs.com/wp-content/uploads/2026/09/RRTL-260929-01.pdf",
          "product_ids": [
            "CSAFPID-0002"
          ],
          "date": "2026-09-21T00:00:00Z"
        }
      ],
      "acknowledgments": [
        {
          "organization": "quellsec.dev",
          "names": [
            "f0rw4rd"
          ]
        }
      ],
      "release_date": "2026-09-21T00:00:00Z"
    }
  ]
}