CyberRota Analysis
AI-GeneratedThe vulnerability affects the nanoMODBUS library, specifically in the handle_read_file_record() function, which improperly handles cumulative response sizes, leading to an out-of-bounds write. This flaw allows unauthenticated network clients to craft requests that can overflow the buffer, potentially resulting in denial of service or remote code execution, especially on embedded systems lacking memory protection. Organizations using nanoMODBUS, particularly in critical infrastructure or IoT environments, should prioritize remediation due to the high severity and potential impact of this vulnerability.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
nanoMODBUS through v1.23.0 contains an out-of-bounds write in the Modbus server-side handle_read_file_record function (FC 0x14, Read File Record) in nanomodbus.c. The function validates that the total request size does not exceed 245 bytes and that each sub-request's record_length is at most 124, but it never validates the CUMULATIVE response size across all sub-requests before processing them.