Description
nanoMODBUS through v1.23.0 contains an off-by-one buffer overflow in the recv_msg_header function of the Modbus/TCP server that allows remote unauthenticated attackers to write one attacker-controlled byte past the end of the 260-byte receive buffer by sending a crafted MBAP frame whose Length field is set to 255.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| debevv | nanoMODBUS | ≤ 1.23.0 | — |
References
- nanoMODBUS - upstream repository (vendor) product
- Vulnerable bounds check at nanomodbus.c line 369 (v1.23.0) product
- CWE-193: Off-by-one Error technical-description
- CWE-787: Out-of-bounds Write technical-description