Shukhratbek Uraiimov

**Name of the Vulnerable Software and Affected Versions** nanoMODBUS versions prior to 1.23.1 **Description** An out-of-bounds write exists in the server-side `handle read file record()` function (FC 0x14, Read File Record) within nanomodbus.c. While the function validates the total request size and individual sub-request `record length`, it fails to validate the cumulative response size across all sub-requests. The `response data size` accumulator, declared as `uint8 t`, can overflow when processing up to 35 sub-requests. This allows a subsequent loop to call `get n()` and `swap regs()`, which writes data unconditionally to a pointer derived from the 260-byte `msg.buf` receive buffer. An unauthenticated network client can send a crafted FC 0x14 request to write approximately 8490 bytes beyond the buffer, potentially leading to memory corruption, denial of service, or remote code execution, especially on embedded or bare-metal systems lacking memory protection. **Recommendations** Update nanoMODBUS to a version later than 1.23.0. As a temporary workaround, restrict network access to the Modbus server to trusted clients only to prevent unauthenticated requests.

**Name of the Vulnerable Software and Affected Versions** nanoMODBUS versions prior to 1.23.1 **Description** An out-of-bounds write exists in the Modbus client-side `recv read device identification res()` function (FC 0x2B/MEI 0x0E, Read Device Identification) within nanomodbus.c. The issue occurs because the server-supplied `object length` field is validated against the remaining PDU size but not against the caller-supplied `buffers length` parameter. After data is copied using `strncpy()`, the code writes a NUL terminator at `buffers out[buf index][object length]`. If a compromised Modbus server provides an `object length` greater than or equal to the `buffers length`, the NUL terminator is written beyond the buffer boundary, leading to the corruption of adjacent stack or heap memory on the client. **Recommendations** Update nanoMODBUS to a version later than 1.23.0. As a temporary workaround, restrict the use of the `recv read device identification res()` function to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** nanoMODBUS versions prior to 1.23.1 **Description** An out-of-bounds stack read exists in the `nmbs read device identification basic()` and `recv read device identification res()` functions within `nanomodbus.c`. The issue occurs because the `object id` variable, which is read directly from a Modbus server, is used as an index for the `order[3]` stack array without bounds checking. If a malicious server provides an `object id` value of 3 or greater, the system reads garbage data from the stack. This value is subsequently used as an index for the `buffers[]` array, resulting in a wild pointer being passed to `strncpy()`. This allows an attacker to perform an arbitrary-address write using server-controlled data. **Recommendations** Update to a version newer than 1.23.0. As a temporary mitigation, restrict communication to trusted Modbus servers to prevent the processing of malicious Read Device Identification responses.

**Name of the Vulnerable Software and Affected Versions** Cesanta Mongoose versions prior to 7.22 **Description** An out-of-bounds read exists in the built-in TLS server function `mg tls server recv hello()`. The issue occurs because the function uses an attacker-controlled `session id len` byte from a TLS ClientHello as a buffer index without validating it against the length of the received data. A remote, unauthenticated attacker can send a crafted ClientHello with an oversized session ID length to read past the receive buffer, resulting in a crash and denial of service for HTTPS, MQTTS, or WSS services utilizing MG TLS BUILTIN. **Recommendations** Update to version 7.22.