Vulnerabilidad · Publicado 05/08/2026
nanoMODBUS hasta la versión 1.23.0 contiene un desbordamiento de búfer (out-of-bounds write) en la función handle_read_file_record() del servidor Modbus (FC 0x14). La validación de tamaño de solicitud es insuficiente, permitiendo que atacantes remotos causen escritura de memoria fuera de límites a través de múltiples sub-solicitudes acumulativas. Afecta infraestructuras SCADA, sistemas embebidos y dispositivos IoT industriales comunes en manufactura y utilidades de LATAM.
nanoMODBUS through v1.23.0 contains an out-of-bounds write in the Modbus server-side handle_read_file_record() function (FC 0x14, Read File Record) in nanomodbus.c. The function validates that the total request size does not exceed 245 bytes and that each sub-request's record_length is at most 124, but it never validates the CUMULATIVE response size across all sub-requests before processing them. The accumulator response_data_size is declared as uint8_t and is incremented by 2 + record_length*2 for each of up to 35 sub-requests; with 35 sub-requests of record_length=124, the cumulative demand is 8750 bytes, which overflows the uint8_t accumulator. A subsequent loop then calls get_n(), an internal function with no bounds checking, once per sub-request to obtain a pointer into the 260-byte msg.buf receive buffer and advances the internal buf_idx by up to 248 bytes per call; swap_regs() then writes to that pointer unconditionally. A single crafted FC 0x14 request from an unauthenticated network client can cause up to ~8490 bytes to be written out of bounds past the 260-byte buffer, corrupting adjacent memory in the server process and leading to denial of service or potential remote code execution, particularly on embedded/bare-metal targets without memory protection.
Score: 9.8/10 — Severidad: CRITICAL — Estado NIST: Received
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-787
Publicado en NIST NVD.