What is the CVSS score of CVE-2026-71265?

CVE-2026-71265 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Domoticz are affected by CVE-2026-71265?

A critical vulnerability in Domoticz's network automation component exposes organizations to unauthorized code execution by any local network attacker, requiring no credentials and enabling full…

How to fix or mitigate CVE-2026-71265?

Within 24 hours, identify all instances of Domoticz in your environment and document the versions in use. Immediately segment these systems from untrusted networks and restrict access to port 1099 to authorized administrative systems only. Within 7 days, implement host-based firewall rules to deny external access to port 1099, disable the MochadTCP component if not operationally required, and deploy network intrusion detection rules to identify MochadTCP buffer overflow exploitation attempts. Within 30 days, evaluate alternative home automation platforms with active security support, establish a migration timeline, and monitor vendor security advisories for CVE-2026-71265 patch availability to plan urgent upgrades once vendor patches are released.

Domoticz CVE-2026-71265

EUVD-2026-53350 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-08-05 TuranSec

GHSA-fgwp-vhm9-7g5q

Buffer Overflow Stack Overflow Domoticz

7.5

CVSS 3.1 · Vendor: TuranSec

Severity by source

Vendor (TuranSec) PRIMARY

7.5 HIGH

AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

AV:A confirmed by port 1099 local-network-only exposure; AC:H reflects branch-specific payload crafting and stack control difficulty; PR:N because Mochad bridge has no authentication gate.

3.1 AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (TuranSec).

CVSS VectorVendor: TuranSec

Attack Vector

Adjacent

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 13:34 vuln.today

CVE Published

Aug 05, 2026 - 12:26 cve.org

HIGH 7.5

DescriptionCVE.org

Domoticz's MochadTCP::MatchLine() handler for MOCHAD_RFSEC messages (hardware/MochadTCP.cpp) copies network-received data from the up-to-1028-byte m_mochadbuffer into a fixed 50-byte stack buffer tempRFSECbuf using strcpy() with no length check, across three separate code branches (DS10A/KR10A/MS10A device types). An attacker on the local network segment able to reach the Mochad TCP bridge (default port 1099, no authentication) can send a crafted packet that overflows tempRFSECbuf by up to several hundred bytes, corrupting the Domoticz worker thread's stack.

AnalysisAI

Stack-based buffer overflow in Domoticz's MochadTCP component allows an unauthenticated attacker on the local network to corrupt the Domoticz worker thread's stack and potentially achieve arbitrary code execution. The MochadTCP::MatchLine() handler in hardware/MochadTCP.cpp uses strcpy() to copy up to 1028 bytes of network-received data into a fixed 50-byte stack buffer (tempRFSECbuf) across three separate device-type branches, with no length validation whatsoever. No CISA KEV listing and no public exploit code have been identified at time of analysis; exploitation requires adjacency to the Domoticz host's network and benefits from the complete absence of authentication on port 1099.

Technical ContextAI

Domoticz is an open-source home automation platform that orchestrates smart home devices. Its MochadTCP component bridges communication with the Mochad TCP daemon, which interfaces X10 RF wireless hardware over a TCP socket on port 1099 by default. The vulnerability is in MochadTCP::MatchLine() (hardware/MochadTCP.cpp), which parses inbound MOCHAD_RFSEC messages representing three specific X10 RF device types: DS10A door/window sensors, KR10A key fob remotes, and MS10A motion sensors. For each of these three branches, the handler copies the raw content of m_mochadbuffer - capable of holding up to 1028 bytes of attacker-controlled network data - into the fixed 50-byte stack-allocated buffer tempRFSECbuf using strcpy(), which performs no length check. This is a canonical CWE-121 (Stack-based Buffer Overflow): the overflow margin reaches approximately 978 bytes, sufficient to overwrite saved return addresses and adjacent stack frame metadata. All Domoticz versions are affected per CPE cpe:2.3:a:domoticz:domoticz:*:*:*:*:*:*:*:* (wildcard, no version floor or ceiling specified).

RemediationAI

No vendor-released patched version has been confirmed at time of analysis - the only references provided point to the Domoticz GitHub source repository (https://github.com/domoticz/domoticz) and the vulnerable file directly, without a tagged release or advisory. Users should actively monitor the repository for a fix commit or new release addressing CVE-2026-71265. As an immediate compensating control, restrict access to TCP port 1099 via host-based firewall rules (e.g., iptables or nftables) or network ACLs, permitting connections only from explicitly trusted hosts - this directly addresses the AV:A exposure without disrupting legitimate X10 device communication. If DS10A, KR10A, or MS10A X10 RF hardware is not in active use, disabling or removing the MochadTCP hardware plugin within Domoticz eliminates the attack surface entirely with no functional trade-off for unaffected device categories. Placing Domoticz on an isolated IoT VLAN with no lateral reachability from general-purpose workstations or guest networks provides defense-in-depth and limits blast radius if any IoT device is compromised. Do not expose port 1099 to untrusted networks or the public internet under any circumstances.