CVE-2026-11826— Thiago Alves OpenPLC 缓冲区错误漏洞

OpenPLC_v3 Heap-Based Buffer Overflow in Modbus Master getData()

OpenPLC_v3 contains a heap-based buffer overflow in the getData() function in webserver/core/modbus_master.cpp. getData() reads characters between two delimiters into a caller-supplied buffer with no size parameter and no bounds check. In parseConfig() the function is invoked with the 100-byte heap-allocated MB_device.dev_name field. An authenticated attacker with access to the OpenPLC web interface can send a crafted HTTP POST to the /modbus endpoint with an oversized device_name value; the value is persisted to mbconfig.cfg and parsed on load, overflowing dev_name and overwriting adjacent struct fields (protocol at offset 108, dev_address at offset 109, ip_port at offset 210). A 200-byte payload writes 100 bytes past the allocation. The result is heap corruption leading to runtime crash and denial of service of the PLC process control loop, with attacker-controlled overwrite of adjacent configuration fields. The upstream repository was archived on 2026-04-04 and no fix is expected; the vendor has confirmed the issue does not affect OpenPLC Runtime v4.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

堆缓冲区溢出

Thiago Alves OpenPLC 缓冲区错误漏洞

openplcproject OpenPLC是openplcproject团队开源的一种可编程逻辑控制器。 Thiago Alves OpenPLC b470206及之前版本存在缓冲区错误漏洞，该漏洞源于webserver/core/modbus_master.cpp中的getData()函数存在基于堆的缓冲区溢出，getData()在两个分隔符之间读取字符到调用者提供的缓冲区，无大小参数和边界检查；在parseConfig()中函数以100字节堆分配的MB_device.dev_name字段调用，经过身

N/A

N/A