CVE-2026-71265 domoticz CVE debrief

Who should care

Domoticz users and administrators, particularly those with exposed Mochad TCP bridges on the local network segment, should be aware of this vulnerability and take steps to mitigate it. Operators of affected systems should review official advisories, assess potential exposure, and implement compensating controls if necessary. Vulnerability management and security teams should prioritize patching and monitor for suspicious activity.

Technical summary

The MochadTCP::MatchLine() handler in Domoticz's hardware/MochadTCP.cpp file copies network-received data into a fixed 50-byte stack buffer using strcpy() with no length check. An attacker on the local network segment can send a crafted packet to overflow the buffer, corrupting the Domoticz worker thread's stack. The vulnerability is triggered by MOCHAD_RFSEC messages for DS10A/KR10A/MS10A device types. Affected deployments should prioritize patching to prevent potential local network segment attacks.

Defensive priority

Domoticz users should prioritize patching to prevent potential local network segment attacks.

Recommended defensive actions

• Apply patches or updates provided by Domoticz to fix the buffer overflow vulnerability
• Restrict access to the Mochad TCP bridge to trusted network segments
• Monitor network traffic for suspicious activity
• Consider implementing additional security controls, such as authentication for the Mochad TCP bridge
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE description indicates a buffer overflow vulnerability in Domoticz's MochadTCP::MatchLine() handler. An attacker on the local network segment can send a crafted packet to overflow a stack buffer, corrupting the Domoticz worker thread's stack. The vulnerability has a CVSS score of 7.5 and is classified as HIGH severity. Evidence is limited to CVE details and NVD information. Defenders should verify affected Domoticz deployments, review official advisories, and assess potential local network segment exposure.

Official resources