A Buffer Overflow Inside Eight OEM Kits
A 9.8-rated stack overflow in Pyramid Solutions' NetStaX EtherNet/IP stack reaches devices that never carry the vendor's name, because the stack is licensed into other people's products.
CISA advisory ICSA-26-246-07, published 3 September, covers the Pyramid Solutions NetStaX EtherNet/IP stack. The vulnerability, CVE-2026-78012, is a stack-based buffer overflow — CWE-121 — scoring 9.8 on CVSS v3.1 and 9.3 on v4.0: network-based, low complexity, no privileges required.
The technical description is precise about the failure. A large Class 3 explicit-message request can exceed the application-side receive buffer without generating an error or warning, which may produce memory corruption, a device crash, or remote code execution. The absence of an error is what makes it dangerous rather than merely broken: nothing on the wire and nothing in a log indicates that a boundary was crossed.
What matters most here is where the code lives. NetStaX is not a product an end user installs; it is a licensed protocol stack that device makers embed inside their own adapters and scanners. Eight variants are affected, all versions before v5.6.1 — the EtherNet/IP Adapter DLL Kit and Adapter Development Kit, the Scanner DLL Kit and Scanner Development Kit, each in standard and CIP Security editions. The CVE therefore surfaces in equipment that never carries the Pyramid Solutions name on its label, and an asset inventory organised by manufacturer will not find it.
That is the general shape of embedded protocol stack risk, and it is worth internalising because it recurs. The plant sees a valve manifold, a drive or a remote IO block from a familiar vendor; inside it is third-party code shared across dozens of unrelated products. When a flaw lands in that layer, the remediation path runs through each OEM's firmware release cycle rather than through the stack author, and those cycles vary from weeks to never.
The practical action is a question to suppliers rather than a scan: does your firmware bundle NetStaX, and if so, which version. Vendors who publish a software bill of materials can answer immediately; the rest will take time, and that difference is itself worth recording for future procurement.
The fix, NetStaX v5.6.1, adds a compile-time assertion, a runtime payload-size check and clearer documentation of the relationships between packet and buffer-size constants — a reasonable defence-in-depth response to a class of bug that recurs whenever those relationships are implicit. Affected sectors listed are Chemical, Critical Manufacturing, Energy, and Water and Wastewater, deployed worldwide. Pyramid Solutions self-reported.
Source: CISA