LiveActive security incident?Get immediate response
CVE Record

CVE-2022-0367: A heap-based buffer overflow flaw was found in libmodbus in function modbus_reply() in src/modbus.c.

A heap-based buffer overflow flaw was found in libmodbus in function modbus_reply() in src/modbus.c.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2022-0367 is a heap-based buffer overflow in libmodbus, a library used to implement Modbus communications. The sources identify the vulnerable function as modbus_reply() and say the issue is fixed in v3.1.7. No CVSS score or active exploitation evidence is provided in the bundle.

Executive priority

Treat this as an inventory and patch management priority for systems using Modbus, especially OT-facing systems. Urgency rises for exposed or safety-critical deployments, but the provided sources do not justify claiming active exploitation or a critical severity.

Technical view

The flaw is classified as CWE-119 and affects libmodbus in src/modbus.c, specifically modbus_reply(). Public references include a GitHub issue, upstream commit, Red Hat bug, and Debian LTS advisories. The bundle identifies v3.1.7 as the fixed release but does not provide detailed impact conditions.

Likely exposure

Exposure is most likely in products, services, or embedded systems that include libmodbus and process Modbus replies using an unfixed build. Organizations should check direct package use and bundled dependencies, especially in operational technology or industrial monitoring stacks.

Exploitation context

The source bundle does not show CISA KEV listing, public active exploitation, or weaponized exploit availability. The practical risk depends on whether a reachable application uses the affected libmodbus code path and whether upstream or distribution fixes have been applied.

Researcher notes

Evidence is limited to a heap overflow description, CWE-119 classification, upstream issue and commit, and distro advisories. The bundle does not include CVSS, detailed affected version ranges, exploitability analysis, or runtime preconditions. Avoid broad product claims without SBOM or vendor confirmation.

Mitigation direction

  • Upgrade libmodbus to v3.1.7 or later where applicable.
  • Apply vendor or distribution security updates, including relevant Debian LTS packages.
  • Identify products that bundle libmodbus rather than using system packages.
  • Limit network exposure of Modbus-capable services to trusted networks.
  • Check upstream and vendor guidance for product-specific remediation.

Validation and detection

  • Inventory libmodbus versions across packages, containers, firmware, and source builds.
  • Confirm whether the upstream fix commit or v3.1.7 is present.
  • Review Debian, Red Hat, and vendor advisories for package status.
  • Verify dependent services were rebuilt or restarted after updating libraries.
  • Document any systems that cannot be patched and their network controls.
Prepared
Confidence
medium
Sources
7

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-119: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2022-0367 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
6Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/alibmodbusFixed in v3.1.7Listed
Weakness

CWE details

CWE-119

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-119 · source CWE mapping

Improper Restriction of Operations within the Bounds of a Memory Buffer

Improper Restriction of Operations within the Bounds of a Memory Buffer represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs