CVE-2026-18368

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-18368", "assignerOrgId": "001d69cf-3fc9-4203-93fb-9865b54e05b2", "state": "PUBLISHED", "assignerShortName": "tlt_net", "dateReserved": "2026-07-30T09:45:28.289Z", "datePublished": "2026-08-13T10:52:35.564Z", "dateUpdated": "2026-08-13T14:43:24.994Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "001d69cf-3fc9-4203-93fb-9865b54e05b2", "shortName": "tlt_net", "dateUpdated": "2026-08-13T10:52:35.564Z"}, "title": "Heap buffer overflow in Modbusgwd", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-122", "description": "CWE-122: Heap-based Buffer Overflow", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-100", "descriptions": [{"lang": "en", "value": "CAPEC-100: Overflow Buffers"}]}], "affected": [{"vendor": "Teltonika Networks", "product": "RUTOS", "packageName": "modbusgwd", "versions": [{"status": "affected", "version": "7.12.0", "lessThanOrEqual": "7.24.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "In Teltonika Networks RUTOS devices, a vulnerability exists in modbusgwd\n due to improper handling of Modbus TCP request data. A remote, \nunauthenticated attacker with access to the affected service could \ntrigger a heap-based buffer overflow, resulting in a denial of service.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "In Teltonika Networks RUTOS devices, a vulnerability exists in modbusgwd\n due to improper handling of Modbus TCP request data. A remote, \nunauthenticated attacker with access to the affected service could \ntrigger a heap-based buffer overflow, resulting in a denial of service."}]}], "references": [{"url": "https://www.teltonika-networks.com/support/security-centre?report=CVE-2026-18368"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "ADJACENT", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 6, "vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}}], "solutions": [{"lang": "en", "value": "Update to RUTOS 7.24.2 or later", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Update to RUTOS 7.24.2 or later"}]}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.4"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-13T14:42:09.334610Z", "id": "CVE-2026-18368", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-13T14:43:24.994Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-18368", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-13T14:42:09.334610Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-13T14:42:29.188Z"}}], "cna": {"title": "Heap buffer overflow in Modbusgwd", "source": {"discovery": "UNKNOWN"}, "impacts": [{"capecId": "CAPEC-100", "descriptions": [{"lang": "en", "value": "CAPEC-100: Overflow Buffers"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6, "Automatable": "NOT_DEFINED", "attackVector": "ADJACENT", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Teltonika Networks", "product": "RUTOS", "versions": [{"status": "affected", "version": "7.12.0", "versionType": "semver", "lessThanOrEqual": "7.24.1"}], "packageName": "modbusgwd", "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Update to RUTOS 7.24.2 or later", "supportingMedia": [{"type": "text/html", "value": "Update to RUTOS 7.24.2 or later", "base64": false}]}], "references": [{"url": "https://www.teltonika-networks.com/support/security-centre?report=CVE-2026-18368"}], "x_generator": {"engine": "Vulnogram 1.0.4"}, "descriptions": [{"lang": "en", "value": "In Teltonika Networks RUTOS devices, a vulnerability exists in modbusgwd\n due to improper handling of Modbus TCP request data. A remote, \nunauthenticated attacker with access to the affected service could \ntrigger a heap-based buffer overflow, resulting in a denial of service.", "supportingMedia": [{"type": "text/html", "value": "In Teltonika Networks RUTOS devices, a vulnerability exists in modbusgwd\n due to improper handling of Modbus TCP request data. A remote, \nunauthenticated attacker with access to the affected service could \ntrigger a heap-based buffer overflow, resulting in a denial of service.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-122", "description": "CWE-122: Heap-based Buffer Overflow"}]}], "providerMetadata": {"orgId": "001d69cf-3fc9-4203-93fb-9865b54e05b2", "shortName": "tlt_net", "dateUpdated": "2026-08-13T10:52:35.564Z"}}}, "cveMetadata": {"cveId": "CVE-2026-18368", "state": "PUBLISHED", "dateUpdated": "2026-08-13T14:43:24.994Z", "dateReserved": "2026-07-30T09:45:28.289Z", "assignerOrgId": "001d69cf-3fc9-4203-93fb-9865b54e05b2", "datePublished": "2026-08-13T10:52:35.564Z", "assignerShortName": "tlt_net"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageName": "modbusgwd", "product": "RUTOS", "vendor": "Teltonika Networks", "versions": [{"lessThanOrEqual": "7.24.1", "status": "affected", "version": "7.12.0", "versionType": "semver"}]}], "source": "001d69cf-3fc9-4203-93fb-9865b54e05b2"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In Teltonika Networks RUTOS devices, a vulnerability exists in modbusgwd\n due to improper handling of Modbus TCP request data. A remote, \nunauthenticated attacker with access to the affected service could \ntrigger a heap-based buffer overflow, resulting in a denial of service."}, {"lang": "es", "value": "En los dispositivos RUTOS de Teltonika Networks, existe una vulnerabilidad en modbusgwd debido a un manejo inadecuado de los datos de solicitud Modbus TCP. Un atacante remoto no autenticado con acceso al servicio afectado podr\u00eda desencadenar un desbordamiento de b\u00fafer basado en mont\u00edculo, lo que resultar\u00eda en una denegaci\u00f3n de servicio."}], "id": "CVE-2026-18368", "lastModified": "2026-10-23T19:10:00.167", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "ADJACENT", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.0, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "001d69cf-3fc9-4203-93fb-9865b54e05b2", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-18368", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-13T14:42:09.334610Z", "version": "2.0.3"}}]}, "published": "2026-08-13T11:17:38.497", "references": [{"source": "001d69cf-3fc9-4203-93fb-9865b54e05b2", "url": "https://www.teltonika-networks.com/support/security-centre?report=CVE-2026-18368"}], "sourceIdentifier": "001d69cf-3fc9-4203-93fb-9865b54e05b2", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-122"}], "source": "001d69cf-3fc9-4203-93fb-9865b54e05b2", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.12.0,7.24.1]"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "RUTOS", "source": "cna", "vendor": "Teltonika Networks"}, "product": "rutos", "vendor": "teltonika-networks"}], "created": "2026-08-13T12:45:03.296927+00:00", "updated": "2026-08-13T13:00:04.973515+00:00", "vendors": ["teltonika-networks", "teltonika-networks$PRODUCT$rutos"]}