{"id":"CVE-2026-82946","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-82946","generatedAt":"2026-10-28T04:35:27.171Z","title":"SOEM version 2.0.0 and earlier contains a vulnerability where a malicious device can crash the master system.","description":"SOEM version 2.0.0 and earlier contains a vulnerability where a malicious device can crash the master system. When the software receives an error response, it clears an internal pointer but continues processing. If another message arrives before timeout, the software attempts to use the cleared pointer, causing a crash. An attacker can trigger this with a simple sequence of two messages.","published":"2026-10-26T09:16:36.000Z","lastModified":"2026-10-26T15:16:45.000Z","status":"Awaiting Analysis","sourceIdentifier":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","cvss":{"version":"3.1","score":6.5,"severity":"MEDIUM","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},"cwe":["CWE-476","CWE-690"],"affected":[],"epss":{"score":0.00169,"percentile":0.06279,"date":"2026-10-27","history":[{"date":"2026-10-26","score":0.00169,"percentile":0.06278}]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.17%). Track it; it rarely justifies an emergency change on its own."},"changes":[{"kind":"new","label":"New CVE","at":"2026-10-26T09:16:36.000Z","detail":{"score":"6.5","severity":"MEDIUM","publishedAt":"2026-10-26T09:16:36.363Z"},"summary":"New CVE, medium severity (CVSS 6.5)."}],"references":[{"url":"https://rt-labs.com/wp-content/uploads/2026/10/RRTL-260921-01.pdf","source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-82946","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}