PT-2024-12115 · Libmodbus · Libmodbus

Goldbinocle · Published 2024-05-01 · Updated 2024-07-03 · CVE-2023-26793

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions libmodbus version 3.1.10

Description The issue is a heap-based buffer overflow vulnerability in the read io status function located in src/modbus.c. This vulnerability can potentially be exploited, but there is no information provided about the estimated number of affected devices or real-world incidents.

Recommendations For libmodbus version 3.1.10, at the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider disabling the read io status function until a patch is available.

Heap Based Buffer Overflow

Weakness Enumeration

CWE-122

Related Identifiers

CVE-2023-26793

Affected Products

Libmodbus

References · 9

• https://github.com/stephane/libmodbus/issues/683 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-26793 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-26793 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-26793 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2023-26793 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-26793 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-26793 · Vendor Advisory
• https://twitter.com/CVEnew/status/1785749753999052994 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1785781865288290546 · Twitter Post