Executive brief
nanoMODBUS is a software library used by embedded devices and microcontrollers to communicate over the Modbus protocol. A security flaw allows a malicious or compromised Modbus server to send specially crafted data that crashes the client device or potentially allows the attacker to take control of it. This could lead to service outages or unauthorized manipulation of industrial and embedded equipment.
Technical details
A stack-based buffer overflow exists in nanoMODBUS through v1.22.0 within the recv_read_registers_res() function in nanomodbus.c. The vulnerability occurs when a client calls nmbs_read_holding_registers() or nmbs_read_input_registers(). The library processes the 'byte_count' field from a server's response and writes the corresponding register data into a caller-provided buffer before verifying that the byte count matches the original requested quantity. An attacker-controlled Modbus TCP server can provide a byte_count of up to 250, leading to an overflow of up to 248 bytes. This can result in a denial of service or remote code execution on the client device.
Affected products
- debevv nanoMODBUS through v1.22.0
Timeline
- 2026-03-18: disclosed: Vulnerability discovered by David Williams
- 2026-05-08: advisory: CVE-2026-29972 published