Stack-based Buffer Overflow vulnerability in libmodbus v3.1.10 allows to overflow the buffer allocated for the Modbus response if the function tries to reply to a Modbus request with an unexpected length.

The remote Debian 12 host has packages installed that are affected by a vulnerability as referenced in the dla-4714 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4714-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                    Thorsten Alteholz     August 01, 2026                               https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : libmodbus     Version        : 3.1.6-2.1+deb12u1     CVE ID         : CVE-2024-10918


    An issue has been found in libmodbus, a library for the Modbus protocol.
    The issue is related to a stack-based Buffer Overflow vulnerability, that     allows to overflow the buffer allocated for the Modbus response if the     function tries to reply to a Modbus request with an unexpected length.



    For Debian 12 bookworm, this problem has been fixed in version     3.1.6-2.1+deb12u1.

    We recommend that you upgrade your libmodbus packages.

    For the detailed security status of libmodbus please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/libmodbus

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4084 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4084-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                   Andreas Henriksson     March 11, 2025                                https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : libmodbus     Version        : 3.1.6-2+deb11u1     CVE ID         : CVE-2022-0367 CVE-2024-10918                      CVE-2024-36843 CVE-2024-36844 CVE-2024-36845     Debian Bug     : 1074422

    Two separate issues where identified and have now been adressed in libmodbus.
    For one of the problems multiple CVE identifiers have been allocated to the     same issue and all of them are mentioned below.

    CVE-2022-0367

        A heap-based buffer overflow flaw was found in libmodbus in function         modbus_reply() in src/modbus.c.

    CVE-2024-10918

        Stack-based Buffer Overflow vulnerability in libmodbus v3.1.10 allows to         overflow the buffer allocated for the Modbus response if the function tries         to reply to a Modbus request with an unexpected length.

    CVE-2024-36843

        This is a duplicate of CVE-2022-0367

    CVE-2024-36844

        This is a duplicate of CVE-2022-0367

    CVE-2024-36845

        This is a duplicate of CVE-2022-0367

    For Debian 11 bullseye, these problems have been fixed in version     3.1.6-2+deb11u1.

    We recommend that you upgrade your libmodbus packages.

    For the detailed security status of libmodbus please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/libmodbus

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Stack-based Buffer Overflow vulnerability in libmodbus v3.1.10 allows to overflow the buffer allocated for     the Modbus response if the function tries to reply to a Modbus request with an unexpected length.
    (CVE-2024-10918)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
331608	Debian dla-4714 : libmodbus-dev - security update	Nessus	Debian Local Security Checks	Local	critical
232625	Debian dla-4084 : libmodbus-dev - security update	Nessus	Debian Local Security Checks	Local	high
228303	Linux Distros Unpatched Vulnerability : CVE-2024-10918	Nessus	Misc.	Local	critical

Detections

Analytics

CVE-2024-10918

critical

Tenable Plugins

critical

high

critical