An unauthenticated remote attacker can inject malicious input into the ModbusServer application because it does not validate the input it fetches from MQTT. Thi…

CVE-2026-44092 describes an unauthenticated remote code injection vulnerability in the ModbusServer application. The flaw exists because the application fails to validate input fetched from MQTT messages. An unauthenticated remote attacker can exploit this to inject malicious input into the system. Successful exploitation may result in integrity and availability loss. The vulnerability is documented by both NVD/NIST and CERT VDE. No authentication is required to exploit this vulnerability, making it particularly dangerous in exposed environments. The issue highlights risks in ICS/SCADA environments where Modbus and MQTT protocols are commonly used together. The advisory VDE-2026-008 provides additional context from CERT VDE.