CVE-2026-18368

In Teltonika Networks RUTOS devices, a vulnerability exists in modbusgwd due to improper handling of Modbus TCP request data. A remote, unauthenticated attacker with access to the affected service could trigger a heap-based buffer overflow, resulting in a denial of service...

CVE-2026-18368

In Teltonika Networks RUTOS devices, a vulnerability exists in modbusgwd due to improper handling of Modbus TCP request data. A remote, unauthenticated attacker with access to the affected service could trigger a heap-based buffer overflow, resulting in a denial of service...

CVE-2026-18368

CVE-2026-18368 Explanation: Teltonika Networks RUTOS devices are affected via the modbusgwd component. The vulnerability arises from improper handling of Modbus TCP request data, enabling a remote, unauthenticated attacker with access to the affected service to trigger a heap-based buffer overflo...

CVE-2026-18368 Heap buffer overflow in Modbusgwd

In Teltonika Networks RUTOS devices, a vulnerability exists in modbusgwd due to improper handling of Modbus TCP request data. A remote, unauthenticated attacker with access to the affected service could trigger a heap-based buffer overflow, resulting in a denial of service...

CVE-2026-44092

A flaw was found in ModbusServer. An unauthenticated remote attacker can inject malicious input into the application due to a lack of input validation when fetching data from MQTT. This vulnerability may lead to a loss of data integrity and system availability...

Schneider Electric SCADAPack and RemoteConnect Improper Check For Unusual or Exceptional Conditions (CVE-2026-0667)

CWE-754 Improper Check for Unusual or Exceptional Conditions vulnerability exists that could cause remote code execution, denial of service, and loss of confidentiality and integrity of the RTU controller when an unauthenticated attacker sends specially crafted Modbus TCP packets to the device...

CVE-2026-71263

The LINUXTCP port of FreeModbus contains an off-by-one bounds check in xMBPortTCPPool demo/LINUXTCP/port/porttcp.c. The check uses a strict greater-than comparison instead of greater-than-or-equal against the 263-byte MBTCPBUFSIZE limit...

EUVD-2026-53348

The LINUXTCP port of FreeModbus contains an off-by-one bounds check in xMBPortTCPPool demo/LINUXTCP/port/porttcp.c. The check if usTCPFrameBytesLeft MBTCPBUFSIZE uses a strict greater-than comparison instead of greater-than-or-equal against the 263-byte MBTCPBUFSIZE limit. An MBAP frame with a...

CVE-2026-71263 FreeModbus LINUXTCP Port Off-by-One Global Buffer Overflow in xMBPortTCPPool()

The LINUXTCP port of FreeModbus contains an off-by-one bounds check in xMBPortTCPPool demo/LINUXTCP/port/porttcp.c. The check uses a strict greater-than comparison instead of greater-than-or-equal against the 263-byte MBTCPBUFSIZE limit...

CVE-2026-71263 FreeModbus LINUXTCP Port Off-by-One Global Buffer Overflow in xMBPortTCPPool()

The LINUXTCP port of FreeModbus contains an off-by-one bounds check in xMBPortTCPPool demo/LINUXTCP/port/porttcp.c. The check uses a strict greater-than comparison instead of greater-than-or-equal against the 263-byte MBTCPBUFSIZE limit...

CVE-2026-71263

The FreeModbus LINUXTCP port has a concrete defect in xMBPortTCPPool(): the code uses a strict greater-than check (usTCPFrameBytesLeft > MB_TCP_BUF_SIZE) against a 263-byte MB_TCP_BUF_SIZE limit. When an MBAP frame with Length 264 is processed, usTCPFrameBytesLeft becomes 263, the check passes...

CVE-2026-71254

nanoMODBUS through v1.23.0 contains an out-of-bounds write in the Modbus server-side handlereadfilerecord function FC 0x14, Read File Record in nanomodbus.c. The function validates that the total request size does not exceed 245 bytes and that each sub-request's recordlength is at most 124, but i...

CVE-2026-71255

nanoMODBUS through v1.23.0 contains an out-of-bounds write in the Modbus client-side recvreaddeviceidentificationres function FC 0x2B/MEI 0x0E, Read Device Identification in nanomodbus.c. The server-supplied objectlength field 0-246 is validated only against the remaining PDU size ressizeleft and...

CVE-2026-71255 nanoMODBUS Client-Side Out-of-Bounds Write via object_length in recv_read_device_identification_res()

nanoMODBUS through v1.23.0 contains an out-of-bounds write in the Modbus client-side recvreaddeviceidentificationres function FC 0x2B/MEI 0x0E, Read Device Identification in nanomodbus.c. The server-supplied objectlength field 0-246 is validated only against the remaining PDU size ressizeleft and...

EUVD-2026-53332

nanoMODBUS through v1.23.0 contains an out-of-bounds write in the Modbus client-side recvreaddeviceidentificationres function FC 0x2B/MEI 0x0E, Read Device Identification in nanomodbus.c. The server-supplied objectlength field 0-246 is validated only against the remaining PDU size ressizeleft and...

CVE-2026-71255

nanoMODBUS through v1.23.0 contains an out-of-bounds write in the Modbus client-side recvreaddeviceidentificationres function FC 0x2B/MEI 0x0E, Read Device Identification in nanomodbus.c. The server-supplied objectlength field 0-246 is validated only against the remaining PDU size ressizeleft and...

CVE-2026-71254 nanoMODBUS Server-Side Out-of-Bounds Write in handle_read_file_record()

nanoMODBUS through v1.23.0 contains an out-of-bounds write in the Modbus server-side handlereadfilerecord function FC 0x14, Read File Record in nanomodbus.c. The function validates that the total request size does not exceed 245 bytes and that each sub-request's recordlength is at most 124, but i...

EUVD-2026-53331

nanoMODBUS through v1.23.0 contains an out-of-bounds write in the Modbus server-side handlereadfilerecord function FC 0x14, Read File Record in nanomodbus.c. The function validates that the total request size does not exceed 245 bytes and that each sub-request's recordlength is at most 124, but i...

CVE-2026-71254

nanoMODBUS through v1.23.0 contains an out-of-bounds write in the Modbus server-side handlereadfilerecord function FC 0x14, Read File Record in nanomodbus.c. The function validates that the total request size does not exceed 245 bytes and that each sub-request's recordlength is at most 124, but i...

CVE-2026-44107

A reboot of the charging controller can be triggered via Modbus TCP without authentication. Therefore, when the Modbus functionality is enabled by opening the port that CharxModbusServer is listening, an unauthenticated attacker can perform a Denial-of-Service attack...