libmodbus v3.1.6 vulnerability allows DoS via crafted message
CVE-2024-36845

4.3MEDIUM

Key Information:

Vendor

libmodbus

Status
LIBModbus
Vendor
CVE Published:
31 May 2024

What is CVE-2024-36845?

An issue arises in the libmodbus library version 3.1.6 due to an invalid pointer in the modbus_receive() function. Attackers can exploit this vulnerability by sending specially crafted messages to the unit-test-server, leading to a Denial of Service condition. This vulnerability highlights the importance of input validation and robust error handling in communication protocols to ensure system stability and security.

References

https://github.com/stephane/libmodbus/issues/750

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

JSON
.