Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-73523— COVESA Open1722 0.9.2 Stack Memory Disclosure via acf-can-listener.c Integer Truncation

CVSS 7.5 · High EPSS 0.32% · P25

Affected Version Matrix 1

VendorProductVersion RangeStatus
COVESAOpen1722≤ 0.9.2affected
Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2026-73523

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
COVESA Open1722 0.9.2 Stack Memory Disclosure via acf-can-listener.c Integer Truncation
Source: CVE Program / CVE List V5
Vulnerability Description
COVESA Open1722 through 0.9.2 contains an integer truncation vulnerability in acf-can-listener.c that allows unauthenticated remote attackers to cause the CAN listener to transmit process stack memory onto the CAN bus by sending a rejected UDP datagram with a matching AVTP stream ID. The num_can_msgs variable declared as uint8_t truncates the -1 error return value from avtp_to_can() to 255, causing a write loop to iterate 255 times over a 15-slot stack array and leak approximately 18 KB of adjacent stack memory as roughly 240 CAN frames to any recipient on the CAN bus.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
数值截断错误
Source: CVE Program / CVE List V5
Vulnerability Title
covesa Open1722 数字错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
covesa Open1722是covesa组织的一款网络服务器设备。 covesa Open1722 0.9.2及之前版本存在数字错误漏洞，该漏洞源于acf-can-listener.c文件中的整数截断问题，num_can_msgs变量声明为uint8_t，将avtp_to_can()函数返回的-1错误值截断为255，导致写循环在15槽栈数组上迭代255次，可能允许未经身份验证的远程攻击者通过发送带有匹配AVTP流ID的拒绝UDP数据报，使CAN监听器将进程栈内存传输到CAN总线，泄露约18KB相邻栈内
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

VendorProductAffected VersionsCPESubscribe
COVESAOpen1722 0 ~ 0.9.2 -

II. Public POCs for CVE-2026-73523

#POC DescriptionSource LinkShenlong Link
AI-Generated POCPremium
Qwen3.6-35B-A3B · 7310 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month

III. Intelligence Information for CVE-2026-73523

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-73523 (1)

Proof of Concept for CVE-2026-73523 (1)

IV. Related Vulnerabilities

Same product: Open1722
Same vendor: COVESA
Same weakness: CWE-197

V. Comments for CVE-2026-73523

No comments yet

Leave a comment