NetStaX EtherNet/IP: Critical Buffer Overflow in Pyramid Solutions Kits, Update to Version 5.6.1

A critical vulnerability in the Pyramid Solutions NetStaX EtherNet/IP Stack can cause memory corruption and crash devices that integrate it. Tracked as CVE-2026-78012, the issue can be exploited over the network without authentication or user interaction.

CISA published the advisory on September 3, 2026, as an initial republication of a communication from Pyramid Solutions. All versions before v5.6.1 of eight EtherNet/IP kits are affected, including variants with CIP Security.

No publicly known cases of targeted exploitation had been reported when the advisory was published. The vulnerability should not be considered minor, however: it has a CVSS v3.1 score of 9.8 out of 10 and can be triggered by sending a Class 3 request larger than the buffer managed by the application.

Eight EtherNet/IP Kits Vulnerable Before v5.6.1

CVE-2026-78012 affects the Pyramid Solutions NetStaX EtherNet/IP Stack. The vulnerable condition is present in all releases before v5.6.1 of the following components:

• EtherNet/IP Adapter DLL Kit (EIPA): versions before v5.6.1;
• EtherNet/IP Adapter DLL Kit with CIP Security (EIPA-SECURE): versions before v5.6.1;
• EtherNet/IP Adapter Development Kit (EADK): versions before v5.6.1;
• EtherNet/IP Adapter Development Kit with CIP Security (EADK-SECURE): versions before v5.6.1;
• EtherNet/IP Scanner DLL Kit (EIPS): versions before v5.6.1;
• EtherNet/IP Scanner DLL Kit with CIP Security (EIPS-SECURE): versions before v5.6.1;
• EtherNet/IP Scanner Development Kit (ESDK): versions before v5.6.1;
• EtherNet/IP Scanner Development Kit with CIP Security (ESDK-SECURE): versions before v5.6.1.

The presence of “Secure” in the name does not eliminate the risk. Variants with CIP Security remain vulnerable when they use a stack release below the required threshold.

No more granular list of affected builds has been published. To assess exposure, organizations must identify the kit embedded in the product and verify that the version actually deployed is at least v5.6.1.

This may require assistance from the equipment manufacturer. NetStaX can be integrated into industrial devices without necessarily appearing under an obvious name in management interfaces or software inventories.

An Oversized Class 3 Request Exceeds the Buffer

The flaw is classified as CWE-121, stack-based buffer overflow. It is located in the code path that handles Class 3 explicit-message requests in EtherNet/IP.

A remote attacker can send a request large enough to exceed the application-side receive buffer. The software does not generate an error or warning in advance that can properly block or report the condition.

Writing beyond the buffer boundaries can alter stack memory. The documented effects include:

• memory corruption;
• a device crash or shutdown;
• a potential remote attack vector;
• the originating device not receiving a CIP error indicating that the request could not be processed.

The last point can complicate monitoring. The system transmitting the malformed message may not receive an error response consistent with the failure that occurred on the recipient.

Arbitrary code execution has not been confirmed as a definite consequence. The buffer overflow and memory corruption make the flaw serious, but the available information does not demonstrate that an attacker can reliably turn it into remote code execution.

Why the Vulnerability Is Critical

CISA assigns CVE-2026-78012 a CVSS v3.1 score of 9.8, with the following vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The rating describes a network-based attack with low complexity that requires no privileges and no action from an operator. The potential impacts on confidentiality, integrity, and availability are all rated high.

The CVSS v4.0 score is also critical at 9.3, with the following vector:

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Operationally, availability is the most immediate risk explicitly documented. An industrial device that crashes after receiving a specially crafted message can disrupt communications, supervision, or functions integrated into the process.

The actual consequences depend on the vulnerable component's role, the plant architecture, and network protections. No specific models of end devices incorporating the stack have been disclosed, and no indicators of compromise associated with a campaign are available.

Potential Impact in Industrial Environments

The products are deployed worldwide. The critical sectors identified are Critical Manufacturing, Energy, Water and Wastewater, and Chemical.

In these environments, a crash is not merely the temporary loss of an IT service. It can make an industrial communications device unavailable, require a restart, or force operators to activate recovery and continuity procedures.

Actual exposure depends primarily on the reachability of the vulnerable service. A system accessible from untrusted networks, poorly segregated corporate segments, or directly from the Internet gives an attacker a much broader attack surface.

Pyramid Solutions reported the issue to CISA. When the advisory was published, the agency had not received reports of public exploitation specifically targeting CVE-2026-78012.

CISA's Known Exploited Vulnerabilities (KEV) catalog does not list the vulnerability, and no federal remediation deadline has been specified. Based on the available information, there is therefore no operational confirmation of active exploitation of the kind that inclusion in the KEV catalog would normally provide.

Updates and Required Checks

The primary fix is to bring every affected kit up to version v5.6.1 or later. No universal update procedure has been published because the process may depend on the product that incorporates the stack.

OT and ICS teams should start with asset inventory, looking for both the NetStaX name and the identifiers EIPA, EIPA-SECURE, EADK, EADK-SECURE, EIPS, EIPS-SECURE, ESDK, and ESDK-SECURE. Where the version is not visible, they should request confirmation from the device or application vendor.

Before deploying the update in production, teams should assess its impact on the industrial process, test it in a controlled environment, and prepare a recovery plan. The need for operational testing should not, however, become an indefinite reason for postponement.

If an immediate update is not possible, CISA recommends reducing the reachability of affected systems:

1. avoid direct exposure to the Internet;
2. place devices and control networks behind firewalls;
3. segregate industrial networks from corporate infrastructure;
4. allow only strictly necessary traffic;
5. use up-to-date VPNs when remote access is required;
6. apply defense-in-depth controls to ICS assets.

A VPN does not fix the buffer overflow and will not protect a plant if authorized endpoints have already been compromised. It restricts the access path; it does not replace the patch.

What to Look for During Monitoring

No IP addresses, malware signatures, or other indicators associated with exploitation have been published. Monitoring should therefore focus on behavior consistent with the flaw.

Events to examine include unusually large Class 3 explicit-message requests, unexplained crashes or restarts of EtherNet/IP devices, and anomalies immediately following the receipt of traffic from unfamiliar systems.

It is also useful to correlate missing CIP responses with crashes or instability on the recipient. A missing response alone does not prove an attack, but it can help reconstruct the sequence preceding the failure.

Any suspicious activity should be handled through internal incident response procedures. The priority remains clear: identify NetStaX integrations, limit network exposure, and update to at least v5.6.1.