CVE-2026-18368

In Teltonika Networks RUTOS devices, a vulnerability exists in modbusgwd due to improper handling of Modbus TCP request data. A remote, unauthenticated attacker with access to the affected service could trigger a heap-based buffer overflow, resulting in a denial of service.

CVSS

No CVSS.

References

Link	Resource
https://www.teltonika-networks.com/support/security-centre?report=CVE-2026-18368

Configurations

No configuration.

History

23 Oct 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) En los dispositivos RUTOS de Teltonika Networks, existe una vulnerabilidad en modbusgwd debido a un manejo inadecuado de los datos de solicitud Modbus TCP. Un atacante remoto no autenticado con acceso al servicio afectado podría desencadenar un desbordamiento de búfer basado en montículo, lo que resultaría en una denegación de servicio.

Information

Published : 2026-08-13 11:17

Updated : 2026-10-23 19:10

NVD link : CVE-2026-18368

Mitre link : CVE-2026-18368

CVE.ORG link : CVE-2026-18368

JSON object : View

Products Affected

No product.

CWE

CWE-122

Heap-based Buffer Overflow

{"id": "CVE-2026-18368", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-18368", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-13T14:42:09.334610Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "001d69cf-3fc9-4203-93fb-9865b54e05b2", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.0, "Automatable": "NOT_DEFINED", "attackVector": "ADJACENT", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "001d69cf-3fc9-4203-93fb-9865b54e05b2", "affectedData": [{"vendor": "Teltonika Networks", "product": "RUTOS", "versions": [{"status": "affected", "version": "7.12.0", "versionType": "semver", "lessThanOrEqual": "7.24.1"}], "packageName": "modbusgwd", "defaultStatus": "unaffected"}]}], "published": "2026-08-13T11:17:38.497", "references": [{"url": "https://www.teltonika-networks.com/support/security-centre?report=CVE-2026-18368", "source": "001d69cf-3fc9-4203-93fb-9865b54e05b2"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "001d69cf-3fc9-4203-93fb-9865b54e05b2", "description": [{"lang": "en", "value": "CWE-122"}]}], "descriptions": [{"lang": "en", "value": "In Teltonika Networks RUTOS devices, a vulnerability exists in modbusgwd\n due to improper handling of Modbus TCP request data. A remote, \nunauthenticated attacker with access to the affected service could \ntrigger a heap-based buffer overflow, resulting in a denial of service."}, {"lang": "es", "value": "En los dispositivos RUTOS de Teltonika Networks, existe una vulnerabilidad en modbusgwd debido a un manejo inadecuado de los datos de solicitud Modbus TCP. Un atacante remoto no autenticado con acceso al servicio afectado podr\u00eda desencadenar un desbordamiento de b\u00fafer basado en mont\u00edculo, lo que resultar\u00eda en una denegaci\u00f3n de servicio."}], "lastModified": "2026-10-23T19:10:00.167", "sourceIdentifier": "001d69cf-3fc9-4203-93fb-9865b54e05b2"}