CVE-2026-82358

Name of the Vulnerable Software and Affected Versions RT-Labs AB C-Open CANopen versions prior to 1.1.1

Description A write protection bypass exists in the SDO (Service Data Object) server implementation within src/co sdo server.c. The issue occurs because the system fails to properly validate write permissions when processing download-segment frames. An unauthenticated attacker on the CAN bus can initiate an SDO upload for a read-only Object Dictionary (OD) entry to set a data pointer to that read-only object, and subsequently send download-segment frames to write to that memory location. Because the download-segment handler does not verify if a download session is active, any CANopen node can overwrite read-only OD entries using two SDO frames. The CANopen protocol operates over the CAN bus and lacks built-in authentication mechanisms.

Recommendations Update to version 1.1.1.