CVE-2026-54410
HighCVSS 8.6Exploitation Probability (EPSS)
Low risk41th percentile - higher than 41% of all known CVEs
Summary
nanoMODBUS up to version 1.23.0 contains an off-by-one buffer overflow in the recv_msg_header() function of the Modbus/TCP server, allowing remote unauthenticated attackers to write one attacker-controlled byte past the end of the 260-byte receive buffer.
Risk Assessment
The buffer overflow can lead to denial of service through invalid memory accesses and, on bare-metal and RTOS targets without memory protection, to one-byte information disclosure and writes to unintended register addresses.
Recommendation
It is recommended to update nanoMODBUS to the latest version to mitigate this vulnerability and implement additional security measures to restrict access to the Modbus/TCP server.
Original NVD description (English source)
nanoMODBUS through v1.23.0 contains an off-by-one buffer overflow in the recv_msg_header() function of the Modbus/TCP server that allows remote unauthenticated attackers to write one attacker-controlled byte past the end of the 260-byte receive buffer by sending a crafted MBAP frame whose Length field is set to 255. The overflow corrupts the adjacent buffer-index field of the nanoMODBUS state structure, resulting in denial of service through invalid memory accesses and, on bare-metal and RTOS targets without memory protection, one-byte information disclosure and writes to unintended register addresses on the Write Multiple Registers (FC16) handler path.