What is the CVSS score of CVE-2024-10918?

CVE-2024-10918 has a contested CVSS base score of 9.8 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of libmodbus are affected by CVE-2024-10918?

libmodbus 3.1.10 contains a critical stack-based buffer overflow in its Modbus TCP/RTU implementation, affecting industrial control systems, SCADA platforms, PLCs, and IoT gateways widely deployed…. A patch is available.

How to fix or mitigate CVE-2024-10918?

Within 24 hours, identify all production systems and embedded applications using libmodbus 3.1.10, with priority on SCADA, HMI, PLC gateways, and any assets accessible from untrusted networks; assess network exposure of Modbus endpoints (TCP port 502 by default). Within 7 days, apply the vendor-released patch to all affected libmodbus instances, rebuild dependent applications, and deploy to production. Within 30 days, complete full remediation verification across the asset inventory, implement network segmentation to restrict Modbus access to trusted internal subnets only, and deploy alerting on Modbus connection anomalies and oversized payloads.

libmodbus CVE-2024-10918

CRITICAL

Stack-based Buffer Overflow (CWE-121)

2025-02-27 prodsec@nozominetworks.com

Buffer Overflow Stack Overflow Libmodbus

Critical

Disputed · 9.8 NVD

Severity by source

Sources disagree (Medium–Critical)

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated network peer sends a malformed Modbus request (AV:N/AC:L/PR:N/UI:N); a stack overflow in the reply path plausibly yields code execution, so C/I/A:H, though demonstrated impact may be limited to availability.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

4.8 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Aug 01, 2026 - 19:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 01, 2026 - 19:22 vuln.today

cvss_changed

Severity Changed

Aug 01, 2026 - 19:22 NVD

MEDIUM CRITICAL

CVSS changed

Aug 01, 2026 - 19:22 NVD

4.8 (MEDIUM) 9.8 (CRITICAL)

Patch released

Apr 02, 2026 - 14:30 nvd

Patch available

Analysis Generated

Mar 28, 2026 - 18:28 vuln.today

CVE Published

Feb 27, 2025 - 12:15 nvd

MEDIUM 4.8

DescriptionNVD

Stack-based Buffer Overflow vulnerability in libmodbus v3.1.10 allows to overflow the buffer allocated for the Modbus response if the function tries to reply to a Modbus request with an unexpected length.

AnalysisAI

Stack-based buffer overflow in libmodbus 3.1.10 lets an attacker overrun the fixed response buffer when the library builds a Modbus reply to a request whose declared length is unexpected. Any application embedding this widely-used Modbus TCP/RTU library - typically PLCs, gateways, SCADA/HMI components and IoT devices acting as Modbus servers - can be crashed or potentially made to execute code by an attacker able to reach the Modbus endpoint. There is no public exploit identified at time of analysis, and the EPSS probability is low (0.21%, 43rd percentile), but the flaw was reported by Nozomi Networks and a vendor fix is available.

Technical ContextAI

libmodbus is a portable open-source C library implementing the Modbus protocol over serial (RTU) and TCP, embedded in a large range of industrial control, energy and IoT firmware to speak to PLCs, sensors and actuators. The root cause is CWE-121 (Stack-based Buffer Overflow): when constructing a response, the code writes into a stack-allocated buffer sized for the expected reply, but a request carrying an unexpected/oversized length field drives more bytes into that buffer than it can hold, corrupting the stack. Because Modbus is a lightweight, historically unauthenticated field-bus protocol, the malformed length can be delivered by any peer that can open a Modbus/TCP (typically port 502) or serial session, and the CPE data confirms the affected component is precisely cpe:2.3:a:libmodbus:libmodbus:3.1.10.

RemediationAI

Patch is available per the vendor: upgrade libmodbus above 3.1.10 to a fixed release and rebuild/redeploy any product that bundles it, then confirm the embedded version rather than relying on the OS package alone. On Debian-based systems, apply the libmodbus updates referenced in the Debian LTS advisories (https://lists.debian.org/debian-lts-announce/2025/03/msg00010.html and https://lists.debian.org/debian-lts-announce/2026/08/msg00003.html) and consult the Nozomi Networks advisory (https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2024-10918) for details. Where immediate patching of embedded/OT devices is not feasible, apply compensating controls: place Modbus endpoints on an isolated OT VLAN and restrict TCP/502 (and any serial-over-IP gateway) with firewall allow-lists so only trusted masters can send requests - this blocks arbitrary peers but requires accurate knowledge of legitimate Modbus clients; and deploy Modbus-aware deep-packet-inspection/IDS rules to drop requests with malformed or out-of-range length fields, accepting that DPI adds latency and may false-positive on non-standard-but-legitimate traffic. Exact fixed version numbers beyond 'greater than 3.1.10' are not enumerated in the provided data and should be taken from the vendor/distribution advisory.