CVE-2026-35227: Missing Release of Resource after Effective Lifetime

An unauthenticated remote attacker may exhaust all available TCP connections in the CODESYS Modbus TCP Server stack if a race condition in connection handling is successfully exploited, preventing legitimate clients from establishing new connections...

CVE-2026-29972: Stack-based Buffer Overflow

nanoMODBUS through v1.22.0 has a stack-based buffer overflow in recvreadregistersres in nanomodbus.c. When a client calls nmbsreadholdingregisters or nmbsreadinputregisters, the library writes register data from the server response to the caller-provided buffer based on the response's bytecount...

Advantech ADAM-6000 Use of Default Password (CVE-2008-5848)

The Advantech ADAM-6000 module has 00000000 as its default password, which makes it easier for remote attackers to obtain access through an HTTP session, and 1 monitor or 2 control the module's Modbus/TCP I/O activity. This plugin only works with Tenable.ot. Please visit...

CVE-2025-41709 Command injection in power analyzer via Modbus-TCP and Modbus-RTU

An unauthenticated remote attacker can perform a command injection via Modbus-TCP or Modbus-RTU to gain read and write access on the affected device...

CVE-2025-41709 Command injection in power analyzer via Modbus-TCP and Modbus-RTU

An unauthenticated remote attacker can perform a command injection via Modbus-TCP or Modbus-RTU to gain read and write access on the affected device...

CVE-2025-41709: Improper Neutralization of Special Elements used in an OS Command

An unauthenticated remote attacker can perform a command injection via Modbus-TCP or Modbus-RTU to gain read and write access on the affected device...

Janitza UMG 96RM-E 24V and Janitza UMG 96RM-E 230V have operating system command injection vulnerabilities

Both Janitza UMG 96RM-E 24V and Janitza UMG 96RM-E 230V are multi-functional power quality analyzers produced by the German company Janitza. Both models have vulnerabilities related to operating system command injection. These vulnerabilities arise from defects in the power analyzer’s processing ...

CVE-2022-50978

An unauthenticated remote attacker could potentially disrupt operations by switching between multiple configuration presets via Modbus TCP...

CVE-2022-50978: Missing Authentication for Critical Function

An unauthenticated remote attacker could potentially disrupt operations by switching between multiple configuration presets via Modbus TCP...

CVE-2021-22764

A CWE-287: Improper Authentication vulnerability exists in PowerLogic PM55xx, PowerLogic PM8ECC, PowerLogic EGX100 and PowerLogic EGX300 see security notification for version infromation that could cause loss of connectivity to the device via Modbus TCP protocol when an attacker sends a specially...

CVE-2024-41798

A vulnerability has been identified in SENTRON 7KM PAC3200 All versions. Affected devices only provide a 4-digit PIN to protect from administrative access via Modbus TCP interface. Attackers with access to the Modbus TCP interface could easily bypass this protection by brute-force attacks or by...

CVE-2025-62578

DVP-12SE - Modbus/TCP Cleartext Transmission of Sensitive Information...

EUVD-2025-205427

DVP-12SE - Modbus/TCP Cleartext Transmission of Sensitive Information...

PT-2025-53451

Name of the Vulnerable Software and Affected Versions DVP-12SE affected versions not specified Description The DVP-12SE device transmits sensitive information in cleartext via the Modbus/TCP protocol. This allows potential attackers to intercept and read sensitive data. The device does not employ...

CVE-2025-62578: Cleartext Transmission of Sensitive Information

DVP-12SE - Modbus/TCP Cleartext Transmission of Sensitive Information...

CVE-2025-59301

Delta Electronics DVP15MC11T lacks proper validation of the modbus/tcp packets and can lead to denial of service...

CVE-2025-59301

Delta Electronics DVP15MC11T lacks proper validation of the modbus/tcp packets and can lead to denial of service...

CVE-2025-59301

Delta Electronics DVP15MC11T is affected by a Denial of Service vulnerability in its Modbus/TCP packet handling due to lack of proper validation. The affected product is Delta Electronics DVP15MC11T; no exploitation details are provided in the documents. Impact: Availability loss (DoS). Remediati...

CVE-2025-59301: Improper Input Validation

Delta Electronics DVP15MC11T lacks proper validation of the modbus/tcp packets and can lead to denial of service...

DIRIS Digiware M-70 Modbus DoS

The vulnerability of the Modbus TCP and Modbus RTU protocols implemented by DIRIS Digiware M-70 communication gateways is related to the lack of authentication for critical functions. Exploiting this vulnerability could allow a malicious actor to cause service failures...