The U.S. Cybersecurity and Infrastructure Security Agency has warned that a critical vulnerability in Pyramid Solutions’ NetStaX EtherNet/IP Stack could cause memory corruption, device crashes or a potential remote attack vector. The advisory, published Sept. 3, identifies the issue as CVE-2026-78012 and assigns it a CVSS 3.1 score of 9.8 with a critical severity rating. CISA said no public exploitation specifically targeting the vulnerability has been reported to the agency.
The flaw affects NetStaX versions before 5.6.1. A large Class 3 explicit-message request can exceed the application-side receive buffer without generating an error or warning, according to CISA. The result could be memory corruption, a device crash or a potential remote attack vector without the originating device receiving a CIP error indicating that the request could not be processed. CISA classifies the issue as a CWE-121 stack-based buffer overflow.
The affected product family includes Pyramid Solutions’ EtherNet/IP Adapter DLL Kit, or EIPA, and its version with CIP Security, EIPA-SECURE. The EtherNet/IP Adapter Development Kit and its CIP Security variant, EADK and EADK-SECURE, are also listed as affected. The advisory also names the EtherNet/IP Scanner DLL Kit products EIPS and EIPS-SECURE, along with the EtherNet/IP Scanner Development Kit products ESDK and ESDK-SECURE.
CISA’s CVSS 3.1 vector describes a network-accessible vulnerability requiring low attack complexity, no privileges and no user interaction. The score also reflects potential high impacts to confidentiality, integrity and availability. Under CVSS 4.0, the issue receives a 9.3 critical score. The advisory identifies critical manufacturing, energy, water and wastewater, and chemical operations among the sectors associated with the technology, with deployments listed worldwide.
NetStaX 5.6.1 addresses the issue with several protections, CISA said. The updated version adds a compile-time assertion and a runtime payload-size check. It also provides clearer documentation of the relationships between packet-size and buffer-size constants. CISA’s advisory includes a Pyramid Solutions account-page link under its mitigation information and separately references a company blog post about the update.
Pyramid Solutions reported the vulnerability to CISA. The advisory describes successful exploitation as capable of causing memory corruption or a device crash and as creating a potential remote attack path. CISA specifically says it has received no report of public exploitation targeting the vulnerability.
CISA recommends minimizing network exposure for control-system devices and ensuring they are not accessible from the internet. It also advises placing control-system networks and remote devices behind firewalls and isolating them from business networks. When remote access is required, the agency recommends more secure methods such as virtual private networks, while noting that VPN security depends on the connected devices and their maintenance.
The agency says organizations should conduct impact analysis and risk assessment before deploying defensive measures. It also encourages operators to use its industrial control systems security guidance. Organizations that observe suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation.