EUVD-2026-53333
GHSA-vq4c-5vwv-g86v
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable via a malicious/MITM Modbus server (AV:N), deterministic no-bounds-check trigger (AC:L), no client auth or interaction (PR:N/UI:N); wild-pointer write of server-controlled data yields full C/I/A.
Primary rating from Vendor (TuranSec).
CVSS VectorVendor: TuranSec
Lifecycle Timeline
6DescriptionCVE.org
nanoMODBUS through v1.23.0 contains an out-of-bounds stack read leading to a wild-pointer write in nmbs_read_device_identification_basic() / recv_read_device_identification_res() in nanomodbus.c. A fixed 3-element stack array order[3] = {0,1,2} maps object IDs to buffer indices. The server-supplied object_id field (0-255, read directly from the wire) is used without any bounds check as buf_index = order[object_id]. When a malicious Modbus server sends a Read Device Identification response with object_id >= 3, this reads an out-of-bounds/garbage byte from the stack adjacent to order[], which is then used as an index into a 3-element buffers[] array of char* pointers. The resulting wild pointer is passed to strncpy() as the destination, causing an arbitrary-address write with server-controlled data.
AnalysisAI
Arbitrary-address memory write in the nanoMODBUS Modbus client library (through v1.23.0) allows a malicious or compromised Modbus server to corrupt the memory of any client that issues a Read Device Identification request. The flaw stems from an unchecked server-supplied object_id used as an array index, ultimately steering a strncpy() destination pointer with attacker-controlled data - a condition that typically leads to remote code execution or crash on embedded/IoT clients. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; the assigned CVSS is 9.8, though exploitation requires the victim client to communicate with an attacker-controlled server.
Technical ContextAI
nanoMODBUS is a lightweight, portable C implementation of the Modbus RTU/TCP protocol used primarily in embedded, industrial, and IoT devices acting as Modbus clients (masters). The vulnerable path is nmbs_read_device_identification_basic() / recv_read_device_identification_res() in nanomodbus.c, which parses a Modbus 'Read Device Identification' (function code 0x2B / MEI type 0x0E) response. A fixed stack array order[3] = {0,1,2} maps each returned object ID to one of three destination buffers. The server-controlled object_id byte (0-255, read straight off the wire) is used as buf_index = order[object_id] with no range validation, so any object_id >= 3 reads a garbage byte from the stack adjacent to order[]. That byte then indexes a 3-element buffers[] array of char* pointers, yielding a wild pointer that is passed as the strncpy() destination. Although CISA/NVD classify this as CWE-125 (Out-of-bounds Read), the primary security consequence is an out-of-bounds/wild-pointer WRITE (closer to CWE-787), because the leaked index drives a destination pointer for a copy of server-supplied bytes.
RemediationAI
No vendor-released patch version was identified at time of analysis - the provided references point only to the GitHub repository (https://github.com/debevv/nanoMODBUS) and the vulnerable source file, not to a tagged fixed release, so upgrade to a specific version cannot yet be cited. Monitor the upstream repository for a release later than 1.23.0 that adds a bounds check on object_id, and apply it once published. As a concrete source-level fix, validate the server-supplied object_id before use - reject or ignore any Read Device Identification object with object_id >= 3 (or >= the size of order[]) before computing order[object_id], and additionally bounds-check the resulting buf_index against the buffers[] array length; this is a low-risk change with no functional downside for compliant servers. As compensating controls until patched: restrict nanoMODBUS clients to communicate only with trusted, authenticated Modbus servers on isolated OT/ICS network segments; block or filter Modbus (TCP/502) traffic from untrusted networks and prevent internet exposure; and where feasible avoid or disable issuing Read Device Identification (FC 0x2B / MEI 0x0E) requests to unverified endpoints - the trade-off is loss of device-identification metadata for those peers.
More in Nanomodbus
View allOut-of-bounds heap/stack write in nanoMODBUS through v1.23.0 lets an unauthenticated network client corrupt memory in th
Memory corruption in nanoMODBUS through v1.23.0 allows a malicious or compromised Modbus server to crash or potentially
Off-by-one buffer overflow in nanoMODBUS through v1.23.0 lets remote unauthenticated attackers write one attacker-contro
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today