EUVD-2025-211110
GHSA-rxjm-cvqw-hr88
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessOperator connects OpenModSim to attacker-controlled Modbus endpoint
-
ExploitServer returns crafted oversized length/count field
-
ExecutionInteger overflow in response parsing (CWE-190)
-
ImpactApplication crash / denial of service
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Integer overflow checks
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires OpenModSim (version <=1.11.0) to process a maliciously crafted Modbus response containing a length/count value that triggers the CWE-190 integer overflow; because OpenModSim functions as a Modbus master simulator, the realistic prerequisite is that the operator connects the tool to an attacker-controlled or compromised Modbus slave/server. The primary limiting factors are that this is a client-side engineering/testing utility rather than an always-listening service, impact is confined to availability (crash/DoS - no code execution or data disclosure), and the attacker must be positioned as the Modbus endpoint the victim chooses to poll. No authentication is required per the provided vector (PR:N), and no fixed version is identified in the available data. |
| Impact | Signals are consistent and point to a genuine-but-limited availability risk rather than a top-tier priority. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) yields 7.5 (HIGH) driven entirely by availability impact (A:H) with no confidentiality or integrity effect, matching CWE-190 integer overflow leading to denial of service. Exploitation likelihood is low: EPSS is 0.15% (4th percentile), the CVE is NOT on CISA KEV, and no public exploit code is confirmed from the provided references. There is no SSVC decision data in the input. A key tension exists: the vector claims UI:N network exploitation, but OpenModSim is a Modbus MASTER/client simulator, so in practice the overflow is most plausibly triggered by crafted data returned from a malicious or compromised Modbus slave/server the operator has chosen to connect to - i.e., some operator action to establish the connection is realistically required, which the UI:N rating does not reflect. Net: a real crash/DoS bug in a niche engineering tool, worth patching but not an emergency; the A:H-only impact and very low EPSS argue against widespread opportunistic exploitation. |
| Exploit ScenarioDerived | An attacker who controls or compromises a Modbus slave/server returns a crafted response whose length or count field triggers an integer overflow in OpenModSim's parsing, crashing the simulator. Because impact is availability-only (A:H, C:N/I:N), the result is a denial of service of the engineering/testing tool rather than code execution or data exposure. No public proof-of-concept exploit is confirmed in the provided references. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Denial of service in OpenModSim 1.11.0 and earlier is triggered when the Modbus master simulator processes a maliciously crafted Modbus response containing a length or count value that causes a CWE-190 integer overflow, resulting in a crash or availability loss. The assessed vector requires user interaction because the operator must connect the tool to an attacker-controlled or compromised Modbus slave/server; no authentication is required (PR:N), and impact is limited to availability with no code execution or data disclosure. No public exploit was identified at time of analysis, CISA KEV does not list this issue, and EPSS is low at 0.15% (4th percentile).
RemediationAI
No vendor-released patch or fixed version was identified at time of analysis. Until an update is published, restrict the simulator's outbound Modbus/TCP connections (typically port 502) to explicitly allowlisted, trusted slave IP addresses so it cannot be pointed at attacker-controlled endpoints; the trade-off is reduced flexibility for ad hoc testing. Where feasible, place a Modbus-aware gateway or proxy in front of test traffic that enforces maximum response length/PDU size and rejects malformed count fields, though such devices may not understand every vendor-specific function code. Run OpenModSim in an isolated lab segment or disposable VM so a crash cannot affect production engineering workstations, and monitor for unexpected process termination after polling untrusted devices. Consult the PRISMI-Team disclosure (https://github.com/PRISMI-Team/VulnDisclos/blob/main/Application/openmodsim/openmodsim.md) and the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2025-66969) for updates; do not treat absence of a patch as confirmation that none will be released.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
OpenModSim is a Modbus master/client simulator used for engineering, testing, and commissioning Modbus/TCP environments. In versions up to 1.11.0, response parsing does not safely validate length or count fields from a Modbus slave response before using them in size or allocation calculations; a crafted value can overflow an integer (CWE-190), leading to incorrect memory handling and a crash. Because this is a client-side engineering utility rather than a continuously listening service, exploitation depends on the operator initiating communication with a malicious or compromised Modbus endpoint. The provided CPE data is unpopulated (n/a), so affected-product identification relies on the OpenModSim project references and the version range stated in the disclosure.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-reachable overflow in parsed Modbus data (AV:N/AC:L) with availability-only impact (A:H, C/I:N), but as a master/client tool the operator must initiate the connection, so UI:R.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
Integer overflow in OpenModSim (<=1.11.0), leading to denial of service
Executive ViewAI
OpenModSim 1.11.0 and earlier contain a high-severity availability flaw that can crash the Modbus master simulator when an operator connects it to a compromised or attacker-controlled Modbus server. The primary impact is disruption to engineering, testing, or validation activities that rely on the simulator, rather than data loss or code execution. No public exploit identified at time of analysis, the issue is not in CISA KEV, and exploitation requires user interaction, so leadership attention should focus on controlled use and monitoring until a vendor fix is available.
No vendor-released patch identified at time of analysis; restrict OpenModSim to trusted Modbus endpoints, segment it from untrusted networks, enforce IP/port allowlisting, monitor for crashes, and apply the vendor patch when available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB