EUVD-2026-28785
GHSA-5hc8-p74q-47pp
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
nanoMODBUS through v1.22.0 has a stack-based buffer overflow in recv_read_registers_res() in nanomodbus.c. When a client calls nmbs_read_holding_registers() or nmbs_read_input_registers(), the library writes register data from the server response to the caller-provided buffer based on the response's byte_count field before validating that byte_count matches the requested quantity. A malicious Modbus TCP server can send a response with byte_count=250 (125 registers) regardless of the requested quantity, causing up to 248 bytes of attacker-controlled data to overflow the buffer, potentially allowing remote code execution.
AnalysisAI
Stack-based buffer overflow in nanoMODBUS v1.22.0 and earlier allows malicious Modbus TCP servers to execute arbitrary code on clients via oversized responses. When client applications call nmbs_read_holding_registers() or nmbs_read_input_registers(), the library fails to validate byte_count before writing server data to the caller's buffer, enabling up to 248 bytes of controlled overflow. No active exploitation confirmed (not in CISA KEV), but proof-of-concept code is publicly available and the vulnerability is automatable (SSVC) with network attack vector (CVSS AV:N/AC:L/PR:N). EPSS data not provided, but the combination of public POC, low complexity, and RCE potential warrants immediate attention for systems using nanoMODBUS as a client.
Technical ContextAI
nanoMODBUS is a lightweight Modbus RTU/TCP library implemented in C. The vulnerability resides in the recv_read_registers_res() function in nanomodbus.c (lines 580-615 per GitHub reference), which handles Modbus function codes 0x03 (Read Holding Registers) and 0x04 (Read Input Registers) responses. The CWE-121 (Stack-based Buffer Overflow) occurs because the library trusts the byte_count field from the server response before validating it against the originally requested quantity of registers. In Modbus protocol, each register is 2 bytes, so a malicious server sending byte_count=250 provides 125 registers worth of data. When the client allocated a buffer for fewer registers (e.g., 1 register = 2 bytes), the memcpy-equivalent operation writes 248 bytes beyond the allocated buffer on the stack, overwriting return addresses or other critical stack data. This is a classic integer-to-buffer mismatch where external input (untrusted server response) controls a memory operation size without proper bounds checking.
RemediationAI
Upgrade to nanoMODBUS version greater than v1.22.0 once a patched release is available - no fix version is specified in the provided intelligence, and the GitHub repository reference points to vulnerable code rather than a patch commit. Monitor the official repository (https://github.com/debevv/nanoMODBUS) for security advisories and patch releases. Until a vendor patch is released, implement compensating controls: (1) Restrict nanoMODBUS client applications to connect only to authenticated and trusted Modbus TCP servers within isolated OT networks, using network segmentation and firewall rules to prevent connections to untrusted endpoints; (2) If feasible, implement application-level validation by wrapping nmbs_read_holding_registers() and nmbs_read_input_registers() calls with checks that allocate maximum-sized buffers (250 bytes) regardless of requested quantity, though this wastes memory and does not address the root cause; (3) Deploy exploit mitigations such as stack canaries (compile with -fstack-protector-strong), ASLR, and DEP/NX to increase exploitation difficulty, recognizing these are defense-in-depth measures that raise the bar but do not eliminate the vulnerability. The POC availability (https://gist.github.com/dwilliams27/a4e26fe747c8561d608f7549804bd85f) can help validate mitigations in lab environments.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-121 – Stack-based Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today