CVE-2026-44092CWE-93

Missing input validation / stripping of CRLF characters in SystemConfigManager

High · published July 30, 2026

CVSS v4.0
8.8
EPSS
1%
Percentile
52.0
In the wild
Unconfirmed
What it is

An unauthenticated remote attacker can inject malicious input into the ModbusServer application because it does not validate the input it fetches from MQTT. This may lead to integrity and availability loss.

The record
Technical detail
CVSS v4.0
8.8 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00683 · 52.0th percentile
Weakness
CWE-93 · Improper Neutralization of CRLF Sequences ('CRLF Injection')
Published
2026-07-30T06:47Z
EPSS history
Timeline
  • 30 JUL 06:47Z
    Missing input validation / stripping of CRLF characters in SystemConfigManager
    cvelistv5