CVE-2026-9090-Modbus-TCP-Write-to-Read-Only-Coils-via-Function-Code-Spoofing

CVE-2026-9090 – Escritura Modbus TCP a Bobinas de Solo Lectura mediante Suplantación de Código de Función Código del Programa Python con simulación pymodbus root@kitploit: modbusplcsim.py - Simulated Modbus PLC with read‑only coils from pymodbus.server.sync import StartTcpServer from...

CVE-2025-41656

CVE-2025-41656 项目总结 本项目旨在模拟CVE-2025-41656 ——一个针对 NodeRED 的未认证远程代码执行漏洞。为此，我们创建了一个小型 SCADA 系统，包含树莓派、执行器和传感器。树莓派中运行着 NodeRED 和 OpenPLC 容器，两者通过 Modbus TCP 通信以控制执行器。此 Python 概念验证脚本用于执行 CVE-2025-41656 攻击。目标是成功构建 PoC 并找到加固系统安全的修复措施。 入门指南 实验环境将包含以下组件 树莓派 3b+ 包含 NodeRED 和 OpenPLC 容器的 Docker Compose 文件 一个执...

smod

smod smod 是一个模块化框架，包含了你对 Modbus 协议进行渗透测试所需的各类诊断与攻击功能。它使用 Python 和 Scapy 实现了完整的 Modbus 协议。该软件可在 Linux/OSX 系统上、python 2.7.x 环境下运行。 摘要 近年来，基于 SCADA（过程控制网络）的系统已从专有的封闭网络逐步转向开源解决方案和启用 TCP/IP 的网络。这使得它们面临与传统计算机网络相同的安全漏洞。 Modbus/TCP 协议被用作参考协议，以展示测试床在对电力系统协议实施网络攻击时的有效性。选择 Modbus/TCP 具体有以下原因： modbus...

scada-scanner

SCADA 扫描器与指纹识别工具 概述 一款高性能异步 SCADA/ICS 扫描器，用于跨网络识别工业控制系统并对其进行指纹识别。可检测漏洞、识别厂商/产品，并生成全面的风险评估报告。 警告：仅限经授权的安全评估使用。未经授权进行扫描可能违反法律法规。 功能特性 核心能力 对 CIDR 范围或单个目标进行快速异步扫描 针对主要工业协议（Modbus、S7、DNP3、BACnet、EtherNet/IP 等）的协议检测 设备指纹识别，可识别厂商、产品与版本 将漏洞与真实世界 CVE 和漏洞利用进行关联 风险评分与评估 技术亮点 多线程架构，支持可配置并发数 令牌桶速率限制，遵守全局请求上限...

modbus-scanner

Modbus 检测扫描器 一个使用 libmodbus 的多线程 C 语言扫描器，用于检测 Modbus/TCP 服务。 该扫描器不仅仅依赖 TCP 端口 502 是否开放。相反，它会建立 Modbus/TCP 连接并发送应用层 Modbus 请求。有效的 Modbus 响应被用作判断 Modbus 服务存在的主要指标。 Modbus/TCP Modbus 是一种工业通信协议，通常被 PLC、RTU、HMI、SCADA 系统、传感器、仪表以及其他工业设备所使用。 Modbus/TCP 通过 TCP 传输 Modbus 应用协议。 标准的 Modbus/TCP 端口是：...

isf

Industrial Exploitation Framework ISFIndustrial Exploitation Framework is a exploitation framework based on Python, it's similar to metasploit framework. ISF is based on open source project routersploit. Read this in other languages:English, 简体中文, Disclaimer Usage of ISF for attacking targets...

CVE-2026-18368

In Teltonika Networks RUTOS devices, a vulnerability exists in modbusgwd due to improper handling of Modbus TCP request data. A remote, unauthenticated attacker with access to the affected service could trigger a heap-based buffer overflow, resulting in a denial of service...

CVE-2026-18368

In Teltonika Networks RUTOS devices, a vulnerability exists in modbusgwd due to improper handling of Modbus TCP request data. A remote, unauthenticated attacker with access to the affected service could trigger a heap-based buffer overflow, resulting in a denial of service...

CVE-2026-18368

CVE-2026-18368 Explanation: Teltonika Networks RUTOS devices are affected via the modbusgwd component. The vulnerability arises from improper handling of Modbus TCP request data, enabling a remote, unauthenticated attacker with access to the affected service to trigger a heap-based buffer overflo...

CVE-2026-18368 Heap buffer overflow in Modbusgwd

In Teltonika Networks RUTOS devices, a vulnerability exists in modbusgwd due to improper handling of Modbus TCP request data. A remote, unauthenticated attacker with access to the affected service could trigger a heap-based buffer overflow, resulting in a denial of service...

Schneider Electric SCADAPack and RemoteConnect Improper Check For Unusual or Exceptional Conditions (CVE-2026-0667)

CWE-754 Improper Check for Unusual or Exceptional Conditions vulnerability exists that could cause remote code execution, denial of service, and loss of confidentiality and integrity of the RTU controller when an unauthenticated attacker sends specially crafted Modbus TCP packets to the device...

CVE-2026-44107 Exposed Reboot via Modbus

A reboot of the charging controller can be triggered via Modbus TCP without authentication. Therefore, when the Modbus functionality is enabled by opening the port that CharxModbusServer is listening, an unauthenticated attacker can perform a Denial-of-Service attack...

CVE-2026-44107

CVE-2026-44107 describes an unauthenticated Denial-of-Service vulnerability in the Modbus TCP interface of the CharxModbusServer. If Modbus functionality is enabled by opening the port, an attacker can trigger a reboot of the charging controller via Modbus TCP without authentication, leading to s...

EUVD-2026-51042

A reboot of the charging controller can be triggered via Modbus TCP without authentication. Therefore, when the Modbus functionality is enabled by opening the port that CharxModbusServer is listening, an unauthenticated attacker can perform a Denial-of-Service attack...

CVE-2026-0667

CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability that could cause arbitrary code execution, denial of service and loss of confidentiality & integrity when communicating over the Modbus TCP protocol...

CVE-2026-0667

CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability that could cause arbitrary code execution, denial of service and loss of confidentiality & integrity when communicating over the Modbus TCP protocol...

CVE-2026-0667

CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability that could cause arbitrary code execution, denial of service and loss of confidentiality & integrity when communicating over the Modbus TCP protocol...

CVE-2026-12818

Delta Electronics DVP12SE PLCs are susceptible to a resource allocation vulnerability without limits or throttling CWE-770 within their Modbus TCP service...

CVE-2026-54410 nanoMODBUS Off-by-One Buffer Overflow in recv_msg_header() via Crafted MBAP Length Field

nanoMODBUS through v1.23.0 contains an off-by-one buffer overflow in the recvmsgheader function of the Modbus/TCP server that allows remote unauthenticated attackers to write one attacker-controlled byte past the end of the 260-byte receive buffer by sending a crafted MBAP frame whose Length fiel...

EUVD-2026-36661

nanoMODBUS through v1.23.0 contains an off-by-one buffer overflow in the recvmsgheader function of the Modbus/TCP server that allows remote unauthenticated attackers to write one attacker-controlled byte past the end of the 260-byte receive buffer by sending a crafted MBAP frame whose Length fiel...