CVE-2026-71265
Received Received - Intake

Stack Buffer Overflow in Domoticz MochadTCP for MOCHAD_RFSEC Messages

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

Description
Domoticz's MochadTCP::MatchLine() handler for MOCHAD_RFSEC messages (hardware/MochadTCP.cpp) copies network-received data from the up-to-1028-byte m_mochadbuffer into a fixed 50-byte stack buffer tempRFSECbuf using strcpy() with no length check, across three separate code branches (DS10A/KR10A/MS10A device types). An attacker on the local network segment able to reach the Mochad TCP bridge (default port 1099, no authentication) can send a crafted packet that overflows tempRFSECbuf by up to several hundred bytes, corrupting the Domoticz worker thread's stack.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-05
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-71265
EUVD
EUVD-2026-53350

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
domoticz domoticz *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-121 A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a stack-based buffer overflow in Domoticz's MochadTCP component. It occurs when the software copies network data into a fixed-size buffer without checking the length, allowing an attacker on the local network to send a specially crafted packet that overflows the buffer and corrupts the stack of Domoticz's worker thread.

Detection Guidance

Check if the Mochad TCP bridge (port 1099) is running on your network. Use network scanning tools like nmap to detect open ports: nmap -p 1099 <target_IP>. Monitor for unusual traffic patterns or crashes in Domoticz logs.

Impact Analysis

An attacker could exploit this to execute arbitrary code on the system running Domoticz, potentially gaining control over the device. This could lead to unauthorized access, data theft, or disruption of home automation systems managed by Domoticz.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Organizations using Domoticz in regulated environments may face compliance breaches if the system is compromised due to this flaw.

Mitigation Strategies

Immediately block external access to port 1099 using a firewall. Update Domoticz to the latest version if a patch is available. Disable the Mochad TCP bridge if not needed. Restrict network access to trusted devices only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-71265. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart