PatchSiren cyber security CVE debrief

CVE-2026-54410 debevv CVE debrief

CVE-2026-54410 is a HIGH severity vulnerability in nanoMODBUS through v1.23.0. The vulnerability is caused by an off-by-one buffer overflow in the recv_msg_header() function of the Modbus/TCP server. This allows remote unauthenticated attackers to write one attacker-controlled byte past the end of the 260-byte receive buffer by sending a crafted MBAP frame whose Length field is set to 255. The overflow corrupts the adjacent buffer-index field of the nanoMODBUS state structure, resulting in denial of service through invalid memory accesses and, on bare-metal and RTOS targets without memory protection, one-byte information disclosure and writes to unintended register addresses on the Write Multiple Registers (FC16) handler path.

Vendor: debevv
Product: nanoMODBUS
CVSS: HIGH 7.8
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-06-14
Original CVE updated: 2026-08-10
Advisory published: 2026-06-14
Advisory updated: 2026-08-10

Who should care

Users of nanoMODBUS through v1.23.0 should be aware of this vulnerability and take steps to mitigate it.

Technical summary

The vulnerability has a CVSS score of 7.8 and is classified as HIGH severity. The CVSS vector is CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:X/U:X.

Defensive priority

HIGH

Recommended defensive actions

Update to a version of nanoMODBUS that is not vulnerable.
Implement network segmentation and isolation to limit the attack surface.
Monitor network traffic for suspicious activity.

Evidence notes

The vulnerability is described in the CVE record [cve-org]. Additional information can be found in the NVD detail [nvd] and the source item URL [source-item].

Sources and references

Verified primary and authoritative sources

CVE-2026-54410 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2026-54410

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2026-54410 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2026-54410

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Source reference
Unverified legacy reference

URL: https://cwe.mitre.org/data/definitions/193.html

309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c
Source reference
Unverified legacy reference

URL: https://cwe.mitre.org/data/definitions/787.html

309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c
Source reference
Unverified legacy reference

URL: https://github.com/debevv/nanoMODBUS

309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c
Source reference
Unverified legacy reference

URL: https://github.com/debevv/nanoMODBUS/blob/v1.23.0/nanomodbus.c

309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.