VIR Vulnerability Intelligence Relay

CVE-2010-4709

high
Published 2011-01-28 · Modified 2026-04-29
💬 Discuss on Community ✚ Propose mitigation
CVSS v3
—
CVSS v4 NEW
—
not yet in upstream
VIR risk
8.6

Description

Heap-based buffer overflow in Automated Solutions Modbus/TCP Master OPC Server before 3.0.2 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a MODBUS response packet with a crafted length field.

Predictions

Exploit likelihood
20%
Patch ETA
—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

No mitigations published for this CVE yet.

The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or — if you've already worked around this in production — publish your fix to the community-verified tier.

✚ Propose a mitigation on Community → Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here with source_tier=community-verified.

Exploits

Public proof-of-concept code below. AS-IS, for defenders and authorised testing only.

Exploit-DB

EDB-16040 dos windows verified
Jeremy Brown · 2011-01-25

Automated Solutions Modbus/TCP OPC Server - Remote Heap Corruption (PoC)

Source code queued for fetch — refresh in a moment.

Application impact
VendorProductVersionsFixed
automatedsolutionsmodbus\/tcp_master_opc_server2.9
automatedsolutionsmodbus\/tcp_master_opc_server2.9.1
automatedsolutionsmodbus\/tcp_master_opc_server2.9.4
automatedsolutionsmodbus\/tcp_master_opc_server2.9.5
automatedsolutionsmodbus\/tcp_master_opc_server2.9_build_2.9.3
automatedsolutionsmodbus\/tcp_master_opc_server2.10
automatedsolutionsmodbus\/tcp_master_opc_server2.11
automatedsolutionsmodbus\/tcp_master_opc_server2.12
automatedsolutionsmodbus\/tcp_master_opc_server2.12.1
automatedsolutionsmodbus\/tcp_master_opc_server2.12.3
automatedsolutionsmodbus\/tcp_master_opc_server3.0.0
automatedsolutionsmodbus\/tcp_master_opc_server{"endIncluding":"3.0.1"}
automatedsolutionsmodbus\/tcp_master_opc_server2.0
automatedsolutionsmodbus\/tcp_master_opc_server2.0_build_1
automatedsolutionsmodbus\/tcp_master_opc_server2.0a
automatedsolutionsmodbus\/tcp_master_opc_server2.1
automatedsolutionsmodbus\/tcp_master_opc_server2.2
automatedsolutionsmodbus\/tcp_master_opc_server2.2a
automatedsolutionsmodbus\/tcp_master_opc_server2.3
automatedsolutionsmodbus\/tcp_master_opc_server2.3a
automatedsolutionsmodbus\/tcp_master_opc_server2.4
automatedsolutionsmodbus\/tcp_master_opc_server2.4a
automatedsolutionsmodbus\/tcp_master_opc_server2.5
automatedsolutionsmodbus\/tcp_master_opc_server2.6
automatedsolutionsmodbus\/tcp_master_opc_server2.6a
automatedsolutionsmodbus\/tcp_master_opc_server2.6b
automatedsolutionsmodbus\/tcp_master_opc_server2.7
automatedsolutionsmodbus\/tcp_master_opc_server2.7a
automatedsolutionsmodbus\/tcp_master_opc_server2.7b
automatedsolutionsmodbus\/tcp_master_opc_server2.7c
automatedsolutionsmodbus\/tcp_master_opc_server2.7d
automatedsolutionsmodbus\/tcp_master_opc_server2.7e
automatedsolutionsmodbus\/tcp_master_opc_server2.7f
automatedsolutionsmodbus\/tcp_master_opc_server2.8

References

CWEs

CWE-119

Community-verified mitigations for this CVE will appear above when contributors publish them.

Verify integrity in audit chain (admin only). AS-IS.