CVE-2026-54410

nanoMODBUS through v1.23.0 contains an off-by-one buffer overflow in the recv_msg_header function of the Modbus/TCP server that allows remote unauthenticated attackers to write one attacker-controlled byte past the end of the 260-byte receive buffer by sending a crafted MBAP frame whose Length field is set to 255.

CVSS v3 8.6 HIGH
CVSS v2.0 9.0 HIGH

8.6^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 4.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact HIGH

Scope UNCHANGED

9.0^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:C

Exploitability : 10.0 / Impact : 8.5

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact COMPLETE

References

Link	Resource
https://cwe.mitre.org/data/definitions/193.html
https://cwe.mitre.org/data/definitions/787.html
https://github.com/debevv/nanoMODBUS
https://github.com/debevv/nanoMODBUS/blob/v1.23.0/nanomodbus.c#L369

Configurations

No configuration.

History

No history.

Information

Published : 2026-06-14 18:17

Updated : 2026-08-10 12:17

NVD link : CVE-2026-54410

Mitre link : CVE-2026-54410

CVE.ORG link : CVE-2026-54410

JSON object : View

Products Affected

No product.

CWE

CWE-193

Off-by-one Error

CWE-787

Out-of-bounds Write

{"id": "CVE-2026-54410", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-54410", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-15T17:00:11.456275Z"}}], "cvssMetricV2": [{"type": "Secondary", "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "cvssData": {"version": "2.0", "baseScore": 9.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:C", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 8.5, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Secondary", "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 4.7, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.8, "Automatable": "YES", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:X/U:X", "exploitMaturity": "PROOF_OF_CONCEPT", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "affectedData": [{"repo": "https://github.com/debevv/nanoMODBUS", "vendor": "debevv", "product": "nanoMODBUS", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.23.0"}], "programFiles": ["nanomodbus.c"], "collectionURL": "https://github.com/debevv/nanoMODBUS", "defaultStatus": "unknown", "programRoutines": [{"name": "recv_msg_header"}]}]}], "published": "2026-06-14T18:17:20.330", "references": [{"url": "https://cwe.mitre.org/data/definitions/193.html", "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"}, {"url": "https://cwe.mitre.org/data/definitions/787.html", "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"}, {"url": "https://github.com/debevv/nanoMODBUS", "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"}, {"url": "https://github.com/debevv/nanoMODBUS/blob/v1.23.0/nanomodbus.c#L369", "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "description": [{"lang": "en", "value": "CWE-193"}, {"lang": "en", "value": "CWE-787"}]}], "descriptions": [{"lang": "en", "value": "nanoMODBUS through v1.23.0 contains an off-by-one buffer overflow in the recv_msg_header function of the Modbus/TCP server that allows remote unauthenticated attackers to write one attacker-controlled byte past the end of the 260-byte receive buffer by sending a crafted MBAP frame whose Length field is set to 255."}, {"lang": "es", "value": "nanoMODBUS hasta la v1.23.0 contiene un desbordamiento de b\u00fafer por un byte en la funci\u00f3n recv_msg_header() del servidor Modbus/TCP que permite a atacantes remotos no autenticados escribir un byte controlado por el atacante m\u00e1s all\u00e1 del final del b\u00fafer de recepci\u00f3n de 260 bytes enviando una trama MBAP manipulada cuyo campo Length est\u00e1 configurado en 255. El desbordamiento corrompe el campo adyacente buffer-index de la estructura de estado de nanoMODBUS, lo que resulta en denegaci\u00f3n de servicio a trav\u00e9s de accesos a memoria no v\u00e1lidos y, en objetivos bare-metal y RTOS sin protecci\u00f3n de memoria, revelaci\u00f3n de informaci\u00f3n de un byte y escrituras a direcciones de registro no intencionadas en la ruta del gestor de Write Multiple Registers (FC16)."}], "lastModified": "2026-08-10T12:17:16.943", "sourceIdentifier": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"}