CyberRota Analysis
AI-GeneratedThe vulnerability affects nanoMODBUS versions up to 1.23.0, where an out-of-bounds stack read can lead to arbitrary memory writes due to improper handling of the server-supplied object_id field. This flaw allows a malicious Modbus server to manipulate memory, potentially leading to remote code execution or system compromise. Organizations using nanoMODBUS, particularly those in industrial control systems, should prioritize patching this critical vulnerability to mitigate severe security risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
nanoMODBUS through v1.23.0 contains an out-of-bounds stack read leading to a wild-pointer write in nmbs_read_device_identification_basic / recv_read_device_identification_res in nanomodbus.c. A fixed 3-element stack array order[3] = {0,1,2} maps object IDs to buffer indices. The server-supplied object_id field (0-255, read directly from the wire) is used without any bounds check as buf_index = order[object_id].