CVE-2026-71255highCWE-787

CVE-2026-71255: falha de alta gravidade em debevv nanoMODBUS

nanoMODBUS Client-Side Out-of-Bounds Write via object_length in recv_read_device_identification_res()

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar nanoMODBUS

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.6epss 0.4%
nanoMODBUS through v1.23.0 contains an out-of-bounds write in the Modbus client-side recv_read_device_identification_res function (FC 0x2B/MEI 0x0E, Read Device Identification) in nanomodbus.c. The server-supplied object_length field (0-246) is validated only against the remaining PDU size (res_size_left) and is never validated against the caller-supplied buffers_length parameter.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Produtos afetados
debevv · nanoMODBUS
CVEs relacionadas — debevv nanoMODBUS

No mesmo produto, das mais perigosas para as menos.

CVE-2026-71256CRITICALnanoMODBUS Client-Side Out-of-Bounds Read Leading to Wild-Pointer Write via object_idEPSS 0.6%CVE-2026-71254CRITICALnanoMODBUS Server-Side Out-of-Bounds Write in handle_read_file_record()EPSS 0.6%CVE-2026-54410HIGHnanoMODBUS Off-by-One Buffer Overflow in recv_msg_header() via Crafted MBAP Length FieldEPSS 0.5%