VULNERABILITY INTELLIGENCE
CVE-2026-54410
CVSS score8.6 HIGH
EPSS probability0.54%
CISA KEVNot currently listed
Published2026-06-14
Last modified2026-08-10
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Description
nanoMODBUS through v1.23.0 contains an off-by-one buffer overflow in the recv_msg_header function of the Modbus/TCP server that allows remote unauthenticated attackers to write one attacker-controlled byte past the end of the 260-byte receive buffer by sending a crafted MBAP frame whose Length field is set to 255.
Weakness classification
- 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c: CWE-193