This article was published on October 26, 2026.
Preface: SOEM is an industrial fieldbus protocol stack (specifically for EtherCAT), it lives at the hardware and networking layer, while AI/LLMs live at the cognitive and data-processing layer. They bridge together in modern systems using the following architecture:
Edge AI and Smart Robotics (The “Brain” meets the “Nervous System”)
Background: The following instructions require the use of the accompanying infographics.
Data Flow Lifecycle (Left side of infographic)
- Downstream Control: The AI Brain detects an object ──> Calculates the 3D spatial trajectory for the robotic arm ──> SOEM 2.0 translates this trajectory into position/velocity target points ──> Commands are packed and dispatched via EtherCAT to the servo drives in real time.
- Upstream Feedback: The joint sensors detect counter-pressure ──> Data passes through the physical network on the fly ──> SOEM 2.0 reads and parses the inputs ──> High-level AI adjusts the grip force dynamically based on this immediate feedback to prevent damaging the object.
Walking Through the Architecture
- The Brain (Block 1): “At the top layer, our Core Brain runs high-level, non-real-time AI workloads, such as computer vision and trajectory planning, on an acceleration platform like an NVIDIA Jetson.”
- The Central Bridge (Block 2): “This interfaces directly with our Real-Time Control layer, where SOEM 2.0 translates those high-level AI trajectories into cyclic EtherCAT Process Data on a strict microsecond-level loop.”
- The Nervous System (Block 3): “This data is dispatched via standard industrial Ethernet down to our physical actuators—the servo drives and grippers that move the physical robot.”
The Exploit Mechanism (Blocks 4 & 6) - “The vulnerability introduces a massive design flaw (Block 6) in how the master handles incoming data.
- EtherCAT relies on ‘Processing on the Fly’. If a malicious or compromised subdevice is introduced to the network, it can reply with a specially crafted, untrusted network message (Block 4).
Vulnerability details: SOEM version 2.0.0 and earlier contains vulnerabilities where a malicious device on the network can send specially crafted messages that cause the master to write data outside allocated memory boundaries. The software performs arithmetic on message length values without proper validation, allowing negative or extremely large values to bypass safety checks. This can corrupt memory and potentially allow an attacker to execute arbitrary code on the master system.
Official announcement: Please refer to the link for details – https://www.tenable.com/cve/CVE-2026-70388