Nanomodbus
Monthly
Arbitrary-address memory write in the nanoMODBUS Modbus client library (through v1.23.0) allows a malicious or compromised Modbus server to corrupt the memory of any client that issues a Read Device Identification request. The flaw stems from an unchecked server-supplied object_id used as an array index, ultimately steering a strncpy() destination pointer with attacker-controlled data - a condition that typically leads to remote code execution or crash on embedded/IoT clients. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; the assigned CVSS is 9.8, though exploitation requires the victim client to communicate with an attacker-controlled server.
Memory corruption in nanoMODBUS through v1.23.0 allows a malicious or compromised Modbus server to crash or potentially execute arbitrary code on connecting clients by sending a crafted Read Device Identification response (FC 0x2B/MEI 0x0E) that triggers an out-of-bounds NUL byte write in recv_read_device_identification_res(). Any application embedding this library and invoking the Device Identification client function is exposed when connecting to an attacker-controlled server. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the off-by-one NUL write primitive into adjacent heap or stack memory represents a realistic path to both denial of service and, depending on allocator layout, code execution.
Out-of-bounds heap/stack write in nanoMODBUS through v1.23.0 lets an unauthenticated network client corrupt memory in the Modbus server via a single crafted Read File Record (FC 0x14) request. The server-side handle_read_file_record() function validates per-request and per-sub-request sizes but never checks the cumulative response size, and a uint8_t accumulator (response_data_size) silently overflows, allowing swap_regs() to write up to ~8490 bytes past the 260-byte receive buffer. There is no public exploit identified at time of analysis, but the flaw yields reliable denial of service and, on embedded/bare-metal targets lacking memory protection, potential remote code execution.
Off-by-one buffer overflow in nanoMODBUS through v1.23.0 lets remote unauthenticated attackers write one attacker-controlled byte past a 260-byte receive buffer in the Modbus/TCP server's recv_msg_header() function. The corruption of the adjacent buffer-index field can cause denial of service on all targets and, on bare-metal/RTOS deployments without memory protection, leak one byte of memory and trigger unintended writes through the Write Multiple Registers (FC16) handler. No public exploit identified at time of analysis, but the bug is trivially reachable by sending a crafted MBAP frame with Length=255.
Arbitrary-address memory write in the nanoMODBUS Modbus client library (through v1.23.0) allows a malicious or compromised Modbus server to corrupt the memory of any client that issues a Read Device Identification request. The flaw stems from an unchecked server-supplied object_id used as an array index, ultimately steering a strncpy() destination pointer with attacker-controlled data - a condition that typically leads to remote code execution or crash on embedded/IoT clients. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; the assigned CVSS is 9.8, though exploitation requires the victim client to communicate with an attacker-controlled server.
Memory corruption in nanoMODBUS through v1.23.0 allows a malicious or compromised Modbus server to crash or potentially execute arbitrary code on connecting clients by sending a crafted Read Device Identification response (FC 0x2B/MEI 0x0E) that triggers an out-of-bounds NUL byte write in recv_read_device_identification_res(). Any application embedding this library and invoking the Device Identification client function is exposed when connecting to an attacker-controlled server. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the off-by-one NUL write primitive into adjacent heap or stack memory represents a realistic path to both denial of service and, depending on allocator layout, code execution.
Out-of-bounds heap/stack write in nanoMODBUS through v1.23.0 lets an unauthenticated network client corrupt memory in the Modbus server via a single crafted Read File Record (FC 0x14) request. The server-side handle_read_file_record() function validates per-request and per-sub-request sizes but never checks the cumulative response size, and a uint8_t accumulator (response_data_size) silently overflows, allowing swap_regs() to write up to ~8490 bytes past the 260-byte receive buffer. There is no public exploit identified at time of analysis, but the flaw yields reliable denial of service and, on embedded/bare-metal targets lacking memory protection, potential remote code execution.
Off-by-one buffer overflow in nanoMODBUS through v1.23.0 lets remote unauthenticated attackers write one attacker-controlled byte past a 260-byte receive buffer in the Modbus/TCP server's recv_msg_header() function. The corruption of the adjacent buffer-index field can cause denial of service on all targets and, on bare-metal/RTOS deployments without memory protection, leak one byte of memory and trigger unintended writes through the Write Multiple Registers (FC16) handler. No public exploit identified at time of analysis, but the bug is trivially reachable by sending a crafted MBAP frame with Length=255.