CVE-2026-54410: nanoMODBUS through v1

Synopsis

An off-by-one buffer overflow in the nanoMODBUS library (versions through 1.23.0) exists in the recv_msg_header() function of the Modbus/TCP server implementation. A remote, unauthenticated attacker can trigger the overflow by sending a crafted MBAP frame with a Length field of 255, writing one attacker-controlled byte past the end of a 260-byte receive buffer. Successful exploitation crashes the affected service and, on bare-metal or RTOS targets without memory protection, enables one-byte data disclosure and unintended writes to register addresses via the FC16 handler path. No fix version has been published; HarborGuard tracks this advisory and will make a patched-image rebuild available as soon as an upstream fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable Modbus/TCP server must be reachable over the network; an attacker sends a crafted MBAP frame to the listening port with no prior session or handshake required.

• AuthenticationNot required

  No credentials or account are needed; the overflow is triggered by a single unauthenticated TCP frame.

• Victim interactionNot required

  No user action or interaction is required; the server processes the malicious frame automatically on receipt.

• Attack complexityDetail

  Exploit conditions are straightforward and reliable; the attacker only needs to set the MBAP Length field to 255 and no race conditions or specific memory layout knowledge are required to trigger the overflow.

Blast Radius

• Crashes the nanoMODBUS Modbus/TCP server through invalid memory accesses, taking the affected service offline.
• On bare-metal and RTOS targets without memory protection, reads one byte of data from memory adjacent to the receive buffer, leaking internal state.
• On bare-metal and RTOS targets without memory protection, writes one attacker-controlled byte to unintended register addresses via the Write Multiple Registers (FC16) handler, corrupting device register state.