CVE-2026-73170: Improper Control of Generation of Code

Nozomi Networks Labs identified a CWE-94: Improper Control of Generation of Code 'Code Injection' vulnerability in the Modbus CSV import workflow of Advantech EKI-1242EIMS in firmware version V1.06.01 that allows a remote authenticated attacker to execute arbitrary Lua code on the device via a...

CVE-2026-73169: Improper Neutralization of Input During Web Page Generation

Nozomi Networks Labs identified a CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in the Modbus transaction management interface of Advantech EKI-1242EIMS in firmware version V1.06.01 that allows a remote authenticated attacker to store...

Astra Linux – Vulnerability in libmodbus

A stack-based buffer overflow vulnerability in libmodbus v3.1.10 allows for the overflow of the buffer allocated for Modbus responses, if the function attempts to respond to a Modbus request with an unexpected length...

Astra Linux – Vulnerability in libmodbus

An invalid pointer in the modbusreceive function of libmodbus v3.1.6 allows attackers to cause a Denial of Service DoS by sending a crafted message to the unit-test-server...

Astra Linux – Vulnerability in Wireshark

A NULL pointer exception occurs in the Modbus dissector in Wireshark versions 3.4.0 to 3.4.9 and 3.2.0 to 3.2.17, allowing for denial of service through packet injection or malicious capture files...

CVE-2026-18368

In Teltonika Networks RUTOS devices, a vulnerability exists in modbusgwd due to improper handling of Modbus TCP request data. A remote, unauthenticated attacker with access to the affected service could trigger a heap-based buffer overflow, resulting in a denial of service...

CVE-2026-18368

In Teltonika Networks RUTOS devices, a vulnerability exists in modbusgwd due to improper handling of Modbus TCP request data. A remote, unauthenticated attacker with access to the affected service could trigger a heap-based buffer overflow, resulting in a denial of service...

CVE-2026-18368

CVE-2026-18368 Explanation: Teltonika Networks RUTOS devices are affected via the modbusgwd component. The vulnerability arises from improper handling of Modbus TCP request data, enabling a remote, unauthenticated attacker with access to the affected service to trigger a heap-based buffer overflo...

CVE-2026-18368 Heap buffer overflow in Modbusgwd

In Teltonika Networks RUTOS devices, a vulnerability exists in modbusgwd due to improper handling of Modbus TCP request data. A remote, unauthenticated attacker with access to the affected service could trigger a heap-based buffer overflow, resulting in a denial of service...

CVE-2026-18368 Heap buffer overflow in Modbusgwd

In Teltonika Networks RUTOS devices, a vulnerability exists in modbusgwd due to improper handling of Modbus TCP request data. A remote, unauthenticated attacker with access to the affected service could trigger a heap-based buffer overflow, resulting in a denial of service...

JLSEC-2026-1252 Stack-based Buffer Overflow vulnerability in libmodbus v3.1.10 allows to overflow the buffer...

Stack-based Buffer Overflow vulnerability in libmodbus v3.1.10 allows to overflow the buffer allocated for the Modbus response if the function tries to reply to a Modbus request with an unexpected length...

CVE-2026-44092

A flaw was found in ModbusServer. An unauthenticated remote attacker can inject malicious input into the application due to a lack of input validation when fetching data from MQTT. This vulnerability may lead to a loss of data integrity and system availability...

Schneider Electric SCADAPack and RemoteConnect Improper Check For Unusual or Exceptional Conditions (CVE-2026-0667)

CWE-754 Improper Check for Unusual or Exceptional Conditions vulnerability exists that could cause remote code execution, denial of service, and loss of confidentiality and integrity of the RTU controller when an unauthenticated attacker sends specially crafted Modbus TCP packets to the device...

CVE-2026-71263

The LINUXTCP port of FreeModbus contains an off-by-one bounds check in xMBPortTCPPool demo/LINUXTCP/port/porttcp.c. The check uses a strict greater-than comparison instead of greater-than-or-equal against the 263-byte MBTCPBUFSIZE limit...

EUVD-2026-53348

The LINUXTCP port of FreeModbus contains an off-by-one bounds check in xMBPortTCPPool demo/LINUXTCP/port/porttcp.c. The check if usTCPFrameBytesLeft MBTCPBUFSIZE uses a strict greater-than comparison instead of greater-than-or-equal against the 263-byte MBTCPBUFSIZE limit. An MBAP frame with a...

CVE-2026-71263 FreeModbus LINUXTCP Port Off-by-One Global Buffer Overflow in xMBPortTCPPool()

The LINUXTCP port of FreeModbus contains an off-by-one bounds check in xMBPortTCPPool demo/LINUXTCP/port/porttcp.c. The check uses a strict greater-than comparison instead of greater-than-or-equal against the 263-byte MBTCPBUFSIZE limit...

CVE-2026-71263

The FreeModbus LINUXTCP port has a concrete defect in xMBPortTCPPool(): the code uses a strict greater-than check (usTCPFrameBytesLeft > MB_TCP_BUF_SIZE) against a 263-byte MB_TCP_BUF_SIZE limit. When an MBAP frame with Length 264 is processed, usTCPFrameBytesLeft becomes 263, the check passes...

CVE-2026-71263 FreeModbus LINUXTCP Port Off-by-One Global Buffer Overflow in xMBPortTCPPool()

The LINUXTCP port of FreeModbus contains an off-by-one bounds check in xMBPortTCPPool demo/LINUXTCP/port/porttcp.c. The check uses a strict greater-than comparison instead of greater-than-or-equal against the 263-byte MBTCPBUFSIZE limit...

CVE-2026-71254

nanoMODBUS through v1.23.0 contains an out-of-bounds write in the Modbus server-side handlereadfilerecord function FC 0x14, Read File Record in nanomodbus.c. The function validates that the total request size does not exceed 245 bytes and that each sub-request's recordlength is at most 124, but i...

CVE-2026-71255

nanoMODBUS through v1.23.0 contains an out-of-bounds write in the Modbus client-side recvreaddeviceidentificationres function FC 0x2B/MEI 0x0E, Read Device Identification in nanomodbus.c. The server-supplied objectlength field 0-246 is validated only against the remaining PDU size ressizeleft and...