A critical out-of-bounds write vulnerability in nanoMODBUS is confirmed to be under active exploitation in the wild.

The Modbus server-side function handle_read_file_record fails to validate the cumulative response size of sub-requests, leading to an integer overflow in the accumulator. This allows unauthenticated network clients to trigger an out-of-bounds write, corrupting memory beyond the designated buffer.

With a CVSS score of 9.8, this flaw poses a severe risk to operational technology and embedded systems. Exploitation can lead to a complete denial of service or remote code execution, which may result in the loss of control over industrial processes or critical infrastructure. Inclusion in the CISA KEV catalog necessitates immediate administrative attention.

Immediate Action: Update to the latest version of nanoMODBUS to ensure proper bounds checking on cumulative response sizes is enforced.

Proactive Monitoring: Monitor network traffic for malformed Modbus packets or unexpected server crashes which may indicate exploitation attempts.

Compensating Controls: Implement strict network segmentation and firewall rules to limit access to Modbus services to authorized, trusted IP addresses only.

Public Exploit Available: Unknown

Given the active exploitation and the critical nature of the flaw, IT and OT teams should treat this as a top-priority item. Ensure all deployments of nanoMODBUS are updated and verify that network-level access controls are strictly enforced.