Modbus Tools Modbus Slave mbs File mbslave.exe buffer overflow
Priority LOW 35CWE-120Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-120 and the CVSS impact.
Summary
A vulnerability has been found in Modbus Tools Modbus Slave up to 7.5.1 and classified as critical. Affected by this vulnerability is an unknown functionality of the file mbslave.exe of the component mbs File Handler. The manipulation leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-217021 was assigned to this vulnerability.
Why it matters now
EPSS 0.00628 50th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD and the CNA
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Modbus Tools | Modbus Slave | 7.5.0; 7.5.1 | — | No fix listed | CNA |
- Modbus Slave VendorModbus Tools Affected 7.5.0; 7.5.1 Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:modbustools:modbus_slave:*:*:*:*:*:*:*:* | up to 7.5.1 | Vulnerable | Modbus Tools |
- cpe:2.3:a:modbustools:modbus_slave:*:*:*:*:*:*:*:* Versions up to 7.5.1 Vulnerable ·Modbus Tools
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2022-4856
- 2026-10-03 Alias added: GHSA-rxg3-r5j8-3qv5
- 2026-10-30 EPSS moved to the 50th–90th percentile
References
More Modbus Tools Modbus Slave vulnerabilities
- TI-2018-13275 Modbus Slave 7.0.0 in modbus tools has a Buffer Overflow. CVSS 3.0HIGH 7.5
- TI-2022-00964 Modbus Tools Modbus Slave Stack-Based Buffer Overflow CVSS 3.1HIGH 7.5
Sources
- CVE-2022-4856 · CVE Program
- CVE-2022-4856 · NVD
- FIRST EPSS
- GHSA-rxg3-r5j8-3qv5 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences