CVE-2026-54410

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-54410", "assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "state": "PUBLISHED", "assignerShortName": "TuranSec", "dateReserved": "2026-06-13T16:39:46.122Z", "datePublished": "2026-06-14T17:10:12.275Z", "dateUpdated": "2026-08-10T11:43:54.292Z"}, "containers": {"cna": {"problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-193", "description": "CWE-193 Off-by-one Error", "type": "CWE"}]}, {"descriptions": [{"lang": "en", "cweId": "CWE-787", "description": "CWE-787 Out-of-bounds Write", "type": "CWE"}]}], "impacts": [{"descriptions": [{"lang": "en", "value": "A remote unauthenticated attacker who can reach a Modbus/TCP server built on nanoMODBUS can send a crafted MBAP frame with the Length field set to 255 to overflow the 260-byte receive buffer by one byte, corrupting the adjacent buf_idx field of the nmbs_t struct with an attacker-controlled value. This yields denial of service (subsequent handler calls treat the corrupted buf_idx as a register count / offset and crash, hang, or return invalid data), one-byte information disclosure on bare-metal and RTOS targets without memory protection (ARM Cortex-M, ESP32, STM32 class), and the possibility of writing to unintended register addresses on the FC16 (Write Multiple Registers) handler path. No authentication, no user interaction, and no special configuration are required."}]}], "affected": [{"vendor": "debevv", "product": "nanoMODBUS", "collectionURL": "https://github.com/debevv/nanoMODBUS", "repo": "https://github.com/debevv/nanoMODBUS", "programFiles": ["nanomodbus.c"], "programRoutines": [{"name": "recv_msg_header"}], "versions": [{"status": "affected", "version": "0", "lessThanOrEqual": "1.23.0", "versionType": "semver"}], "defaultStatus": "unknown"}], "descriptions": [{"lang": "en", "value": "nanoMODBUS through v1.23.0 contains an off-by-one buffer overflow in the recv_msg_header function of the Modbus/TCP server that allows remote unauthenticated attackers to write one attacker-controlled byte past the end of the 260-byte receive buffer by sending a crafted MBAP frame whose Length field is set to 255.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>nanoMODBUS through v1.23.0 contains an off-by-one buffer overflow in the recv_msg_header function of the Modbus/TCP server that allows remote unauthenticated attackers to write one attacker-controlled byte past the end of the 260-byte receive buffer by sending a crafted MBAP frame whose Length field is set to 255.</p>"}]}], "references": [{"url": "https://github.com/debevv/nanoMODBUS", "name": "nanoMODBUS - upstream repository (vendor)", "tags": ["product"]}, {"url": "https://github.com/debevv/nanoMODBUS/blob/v1.23.0/nanomodbus.c#L369", "name": "Vulnerable bounds check at nanomodbus.c line 369 (v1.23.0)", "tags": ["product"]}, {"url": "https://cwe.mitre.org/data/definitions/193.html", "name": "CWE-193: Off-by-one Error", "tags": ["technical-description"]}, {"url": "https://cwe.mitre.org/data/definitions/787.html", "name": "CWE-787: Out-of-bounds Write", "tags": ["technical-description"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "An attacker who can reach the TCP listening port of a Modbus/TCP server built on nanoMODBUS (typically TCP/502 on industrial / OT networks) sends a single crafted MBAP frame with Length=255 to corrupt the buf_idx field of the nmbs_t struct, causing denial of service or, on memory-protection-less embedded targets, additional information disclosure or unintended register writes."}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "NONE", "exploitMaturity": "PROOF_OF_CONCEPT", "Safety": "NOT_DEFINED", "Automatable": "YES", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "HIGH", "baseScore": 7.8, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:P/AU:Y"}}, {"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "HIGH", "baseSeverity": "HIGH", "baseScore": 8.6, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H"}}, {"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV2_0": {"version": "2.0", "accessVector": "NETWORK", "accessComplexity": "LOW", "authentication": "NONE", "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "availabilityImpact": "COMPLETE", "baseScore": 9, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:C"}}], "credits": [{"lang": "en", "value": "Burxonov Muslimbek", "type": "finder"}], "source": {"discovery": "EXTERNAL"}, "x_author": "Burxonov Muslimbek", "x_assigner_notes": "Vendor 'debevv' is a single-maintainer GitHub account; nanoMODBUS is MIT-licensed. The vulnerable bounds check was verified by source inspection of v1.22.0, v1.22.1, and v1.23.0 (latest at publish time) - the issue is present in all three; affected range is therefore 0 through v1.23.0 (inclusive) with defaultStatus 'unknown' pending vendor confirmation of a fixed release. CVSS scoring follows the submitter's CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H = 8.6) and translates to 4.0 with VC:L/VI:L/VA:H, SC/SI/SA:N (= 8.7) and 2.0 with C:P/I:P/A:C (= 9.0).", "title": "nanoMODBUS Off-by-One Buffer Overflow in recv_msg_header() via Crafted MBAP Length Field", "providerMetadata": {"orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "shortName": "TuranSec", "dateUpdated": "2026-08-10T11:43:54.292Z"}, "datePublic": "2026-06-14T17:10:12.275Z"}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-15T17:00:11.456275Z", "id": "CVE-2026-54410", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-15T17:05:25.499Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-54410", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-15T17:00:11.456275Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-15T17:00:28.535Z"}}], "cna": {"title": "nanoMODBUS Off-by-One Buffer Overflow in recv_msg_header() via Crafted MBAP Length Field", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Burxonov Muslimbek"}], "impacts": [{"descriptions": [{"lang": "en", "value": "A remote unauthenticated attacker who can reach a Modbus/TCP server built on nanoMODBUS can send a crafted MBAP frame with the Length field set to 255 to overflow the 260-byte receive buffer by one byte, corrupting the adjacent buf_idx field of the nmbs_t struct with an attacker-controlled value. This yields denial of service (subsequent handler calls treat the corrupted buf_idx as a register count / offset and crash, hang, or return invalid data), one-byte information disclosure on bare-metal and RTOS targets without memory protection (ARM Cortex-M, ESP32, STM32 class), and the possibility of writing to unintended register addresses on the FC16 (Write Multiple Registers) handler path. No authentication, no user interaction, and no special configuration are required."}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.8, "Automatable": "YES", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:P/AU:Y", "exploitMaturity": "PROOF_OF_CONCEPT", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "An attacker who can reach the TCP listening port of a Modbus/TCP server built on nanoMODBUS (typically TCP/502 on industrial / OT networks) sends a single crafted MBAP frame with Length=255 to corrupt the buf_idx field of the nmbs_t struct, causing denial of service or, on memory-protection-less embedded targets, additional information disclosure or unintended register writes."}]}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "CVSS", "cvssV2_0": {"version": "2.0", "baseScore": 9, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:C", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "PARTIAL"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/debevv/nanoMODBUS", "vendor": "debevv", "product": "nanoMODBUS", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.23.0"}], "programFiles": ["nanomodbus.c"], "collectionURL": "https://github.com/debevv/nanoMODBUS", "defaultStatus": "unknown", "programRoutines": [{"name": "recv_msg_header"}]}], "x_author": "Burxonov Muslimbek", "datePublic": "2026-06-14T17:10:12.275Z", "references": [{"url": "https://github.com/debevv/nanoMODBUS", "name": "nanoMODBUS - upstream repository (vendor)", "tags": ["product"]}, {"url": "https://github.com/debevv/nanoMODBUS/blob/v1.23.0/nanomodbus.c#L369", "name": "Vulnerable bounds check at nanomodbus.c line 369 (v1.23.0)", "tags": ["product"]}, {"url": "https://cwe.mitre.org/data/definitions/193.html", "name": "CWE-193: Off-by-one Error", "tags": ["technical-description"]}, {"url": "https://cwe.mitre.org/data/definitions/787.html", "name": "CWE-787: Out-of-bounds Write", "tags": ["technical-description"]}], "descriptions": [{"lang": "en", "value": "nanoMODBUS through v1.23.0 contains an off-by-one buffer overflow in the recv_msg_header function of the Modbus/TCP server that allows remote unauthenticated attackers to write one attacker-controlled byte past the end of the 260-byte receive buffer by sending a crafted MBAP frame whose Length field is set to 255.", "supportingMedia": [{"type": "text/html", "value": "<p>nanoMODBUS through v1.23.0 contains an off-by-one buffer overflow in the recv_msg_header function of the Modbus/TCP server that allows remote unauthenticated attackers to write one attacker-controlled byte past the end of the 260-byte receive buffer by sending a crafted MBAP frame whose Length field is set to 255.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-193", "description": "CWE-193 Off-by-one Error"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-787", "description": "CWE-787 Out-of-bounds Write"}]}], "providerMetadata": {"orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "shortName": "TuranSec", "dateUpdated": "2026-08-10T11:43:54.292Z"}, "x_assigner_notes": "Vendor 'debevv' is a single-maintainer GitHub account; nanoMODBUS is MIT-licensed. The vulnerable bounds check was verified by source inspection of v1.22.0, v1.22.1, and v1.23.0 (latest at publish time) - the issue is present in all three; affected range is therefore 0 through v1.23.0 (inclusive) with defaultStatus 'unknown' pending vendor confirmation of a fixed release. CVSS scoring follows the submitter's CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H = 8.6) and translates to 4.0 with VC:L/VI:L/VA:H, SC/SI/SA:N (= 8.7) and 2.0 with C:P/I:P/A:C (= 9.0)."}}, "cveMetadata": {"cveId": "CVE-2026-54410", "state": "PUBLISHED", "dateUpdated": "2026-08-10T11:43:54.292Z", "dateReserved": "2026-06-13T16:39:46.122Z", "assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "datePublished": "2026-06-14T17:10:12.275Z", "assignerShortName": "TuranSec"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://github.com/debevv/nanoMODBUS", "defaultStatus": "unknown", "product": "nanoMODBUS", "programFiles": ["nanomodbus.c"], "programRoutines": [{"name": "recv_msg_header"}], "repo": "https://github.com/debevv/nanoMODBUS", "vendor": "debevv", "versions": [{"lessThanOrEqual": "1.23.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "nanoMODBUS through v1.23.0 contains an off-by-one buffer overflow in the recv_msg_header function of the Modbus/TCP server that allows remote unauthenticated attackers to write one attacker-controlled byte past the end of the 260-byte receive buffer by sending a crafted MBAP frame whose Length field is set to 255."}, {"lang": "es", "value": "nanoMODBUS hasta la v1.23.0 contiene un desbordamiento de b\u00fafer por un byte en la funci\u00f3n recv_msg_header() del servidor Modbus/TCP que permite a atacantes remotos no autenticados escribir un byte controlado por el atacante m\u00e1s all\u00e1 del final del b\u00fafer de recepci\u00f3n de 260 bytes enviando una trama MBAP manipulada cuyo campo Length est\u00e1 configurado en 255. El desbordamiento corrompe el campo adyacente buffer-index de la estructura de estado de nanoMODBUS, lo que resulta en denegaci\u00f3n de servicio a trav\u00e9s de accesos a memoria no v\u00e1lidos y, en objetivos bare-metal y RTOS sin protecci\u00f3n de memoria, revelaci\u00f3n de informaci\u00f3n de un byte y escrituras a direcciones de registro no intencionadas en la ruta del gestor de Write Multiple Registers (FC16)."}], "id": "CVE-2026-54410", "lastModified": "2026-08-10T12:17:16.943", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 9.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:C", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 8.5, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 4.7, "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "YES", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-54410", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-15T17:00:11.456275Z", "version": "2.0.3"}}]}, "published": "2026-06-14T18:17:20.330", "references": [{"source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "url": "https://cwe.mitre.org/data/definitions/193.html"}, {"source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "url": "https://cwe.mitre.org/data/definitions/787.html"}, {"source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "url": "https://github.com/debevv/nanoMODBUS"}, {"source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "url": "https://github.com/debevv/nanoMODBUS/blob/v1.23.0/nanomodbus.c#L369"}], "sourceIdentifier": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-193"}, {"lang": "en", "value": "CWE-787"}], "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.23.0]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "nanoMODBUS", "source": "cna", "vendor": "debevv"}, "product": "nanomodbus", "vendor": "debevv"}], "created": "2026-06-14T18:30:12.976130+00:00", "updated": "2026-08-11T00:15:04.413834+00:00", "vendors": ["debevv", "debevv$PRODUCT$nanomodbus"]}