https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 15:38:03 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-82358 <p>RT-Labs AB C-Open CANopen contains a write protection bypass in the SDO (Service Data Object) server implementation &#39;src/co_sdo_server.c&#39; that fails to properly validate write permissions when processing download-segment frames. An unauthenticated attacker on the CAN bus can initiate an SDO upload for a read-only Object Dictionary (OD) entry, which sets a data pointer to the read-only object, then send download-segment frames to write to that memory location. The download-segment handler does not verify that a download session is active, allowing any CANopen node to overwrite read-only OD entries using two SDO frames. Note that CANopen protocol operates over CAN bus and does not provide built-in authentication mechanisms. Fixed in 1.1.1.</p> <p>RT-Labs AB C-Open CANopen contains a write protection bypass in the SDO (Service Data Object) server implementation &#39;src/co_sdo_server.c&#39; that fails to properly validate write permissions when processing download-segment frames. An unauthenticated attacker on the CAN bus can initiate an SDO upload for a read-only Object Dictionary (OD) entry, which sets a data pointer to the read-only object, then send download-segment frames to write to that memory location. The download-segment handler does not verify that a download session is active, allowing any CANopen node to overwrite read-only OD entries using two SDO frames. Note that CANopen protocol operates over CAN bus and does not provide built-in authentication mechanisms. Fixed in 1.1.1.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-82358 https://vulnerability.circl.lu/vuln/ghsa-grg4-frf9-pvw5 <p>RT-Labs AB C-Open CANopen contains a write protection bypass in the SDO (Service Data Object) server implementation &#39;src/co_sdo_server.c&#39; that fails to properly validate write permissions when processing download-segment frames. An unauthenticated attacker on the CAN bus can initiate an SDO upload for a read-only Object Dictionary (OD) entry, which sets a data pointer to the read-only object, then send download-segment frames to write to that memory location. The download-segment handler does not verify that a download session is active, allowing any CANopen node to overwrite read-only OD entries using two SDO frames. Note that CANopen protocol operates over CAN bus and does not provide built-in authentication mechanisms. Fixed in 1.1.1.</p> <p>RT-Labs AB C-Open CANopen contains a write protection bypass in the SDO (Service Data Object) server implementation &#39;src/co_sdo_server.c&#39; that fails to properly validate write permissions when processing download-segment frames. An unauthenticated attacker on the CAN bus can initiate an SDO upload for a read-only Object Dictionary (OD) entry, which sets a data pointer to the read-only object, then send download-segment frames to write to that memory location. The download-segment handler does not verify that a download session is active, allowing any CANopen node to overwrite read-only OD entries using two SDO frames. Note that CANopen protocol operates over CAN bus and does not provide built-in authentication mechanisms. Fixed in 1.1.1.</p> https://vulnerability.circl.lu/vuln/ghsa-grg4-frf9-pvw5