Vulnerability · Published Oct 1, 2026 · Assigned by cisa-cg

CVE-2026-82358RT-Labs AB C-Open CANopen SDO Server Write Protection Bypass

Medium 6.5

In plain English

A medium-severity incorrect authorization in C-Open from RT-Labs AB. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.2%top 85.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

RT-Labs AB C-Open CANopen contains a write protection bypass in the SDO (Service Data Object) server implementation 'src/co_sdo_server.c' that fails to properly validate write permissions when processing download-segment frames. An unauthenticated attacker on the CAN bus can initiate an SDO upload for a read-only Object Dictionary (OD) entry, which sets a data pointer to the read-only object, then send download-segment frames to write to that memory location. The download-segment handler does not verify that a download session is active, allowing any CANopen node to overwrite read-only OD entries using two SDO frames. Note that CANopen protocol operates over CAN bus and does not provide built-in authentication mechanisms. Fixed in 1.1.1.

Affected products (as reported)

Vendor	Product	Versions
RT-Labs AB	C-Open	0 – before 1.1.1

Weakness: CWE-863 · Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References

url vendor-advisory
url release-notes
url third-party-advisory
url vdb-entry