nanoMODBUS through v1.23.0 contains an out-of-bounds write in the Modbus client-side recv_read_device_identification_res() function (FC 0x2B/MEI 0x0E, Read Devi…

nanoMODBUS through v1.23.0 contains an out-of-bounds write vulnerability in the client-side recv_read_device_identification_res() function within nanomodbus.c. The vulnerability stems from improper validation of the server-supplied object_length field, which is only checked against the remaining PDU size but never against the caller-supplied buffers_length parameter. After copying data using strncpy(), the code unconditionally writes a NUL terminator at a position determined by object_length, potentially past the end of the allocated buffer. A malicious or compromised Modbus server can exploit this by sending a crafted response where object_length is greater than or equal to the client's buffers_length. This causes the NUL write to land outside the caller-provided buffer, corrupting adjacent stack or heap memory on the client side. The vulnerability affects industrial control and IoT environments using the nanoMODBUS library for Modbus communications.