Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-11826— OpenPLC_v3 Heap-Based Buffer Overflow in Modbus Master getData()

CVSS 8.8 · High EPSS 0.42% · P35

Affected Version Matrix 1

VendorProductVersion RangeStatus
openplcprojectOpenPLC_v3≤ b470206affected
Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2026-11826

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
OpenPLC_v3 Heap-Based Buffer Overflow in Modbus Master getData()
Source: CVE Program / CVE List V5
Vulnerability Description
OpenPLC_v3 contains a heap-based buffer overflow in the getData() function in webserver/core/modbus_master.cpp. getData() reads characters between two delimiters into a caller-supplied buffer with no size parameter and no bounds check. In parseConfig() the function is invoked with the 100-byte heap-allocated MB_device.dev_name field. An authenticated attacker with access to the OpenPLC web interface can send a crafted HTTP POST to the /modbus endpoint with an oversized device_name value; the value is persisted to mbconfig.cfg and parsed on load, overflowing dev_name and overwriting adjacent struct fields (protocol at offset 108, dev_address at offset 109, ip_port at offset 210). A 200-byte payload writes 100 bytes past the allocation. The result is heap corruption leading to runtime crash and denial of service of the PLC process control loop, with attacker-controlled overwrite of adjacent configuration fields. The upstream repository was archived on 2026-04-04 and no fix is expected; the vendor has confirmed the issue does not affect OpenPLC Runtime v4.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
堆缓冲区溢出
Source: CVE Program / CVE List V5
Vulnerability Title
Thiago Alves OpenPLC 缓冲区错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
openplcproject OpenPLC是openplcproject团队开源的一种可编程逻辑控制器。 Thiago Alves OpenPLC b470206及之前版本存在缓冲区错误漏洞，该漏洞源于webserver/core/modbus_master.cpp中的getData()函数存在基于堆的缓冲区溢出，getData()在两个分隔符之间读取字符到调用者提供的缓冲区，无大小参数和边界检查；在parseConfig()中函数以100字节堆分配的MB_device.dev_name字段调用，经过身
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

VendorProductAffected VersionsCPESubscribe
openplcprojectOpenPLC_v3 0 ~ b470206 -

II. Public POCs for CVE-2026-11826

#POC DescriptionSource LinkShenlong Link
AI-Generated POCPremium
Qwen3.6-35B-A3B · 7764 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month

III. Intelligence Information for CVE-2026-11826

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-11826 (1)

Vendor Advisories for CVE-2026-11826 (1)

Proof of Concept for CVE-2026-11826 (1)

Vendor Pages for CVE-2026-11826 (1)

IV. Related Vulnerabilities

Same product: OpenPLC_v3
Same vendor: openplcproject
Same weakness: CWE-122

V. Comments for CVE-2026-11826

No comments yet

Leave a comment