Freemodbus
Monthly
Out-of-bounds write in the LINUXTCP demo port of FreeModbus (cwalter-at fork) lets a remote, unauthenticated attacker overflow the static aucTCPBuf receive buffer by sending a single crafted Modbus TCP (MBAP) frame. Because the xMBPortTCPPool() length validation uses a strict '>' instead of '>=' against the 263-byte MB_TCP_BUF_SIZE, a frame declaring Length 264 passes the check and recv() writes 7 bytes past the buffer into the adjacent usTCPBufPos variable, corrupting parser state. CVSS is 9.1 (I:H/A:H); there is no public exploit identified at time of analysis and it is not on CISA KEV.
Buffer Overflow vulnerability in SILA Embedded Solutions GmbH freemodbus v.2018-09-12 allows a remtoe attacker to cause a denial of service via the LINUXTCP server component. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Out-of-bounds write in the LINUXTCP demo port of FreeModbus (cwalter-at fork) lets a remote, unauthenticated attacker overflow the static aucTCPBuf receive buffer by sending a single crafted Modbus TCP (MBAP) frame. Because the xMBPortTCPPool() length validation uses a strict '>' instead of '>=' against the 263-byte MB_TCP_BUF_SIZE, a frame declaring Length 264 passes the check and recv() writes 7 bytes past the buffer into the adjacent usTCPBufPos variable, corrupting parser state. CVSS is 9.1 (I:H/A:H); there is no public exploit identified at time of analysis and it is not on CISA KEV.
Buffer Overflow vulnerability in SILA Embedded Solutions GmbH freemodbus v.2018-09-12 allows a remtoe attacker to cause a denial of service via the LINUXTCP server component. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.