CVE-2026-71265

Received Received - Intake

Stack Buffer Overflow in Domoticz MochadTCP for MOCHAD_RFSEC Messages

Publication date: 2026-08-05

Last updated on: 2026-08-10

Assigner: TuranSec

Description

Domoticz's MochadTCP::MatchLine handler for MOCHAD_RFSEC messages (hardware/MochadTCP.cpp) copies network-received data from the up-to-1028-byte m_mochadbuffer into a fixed 50-byte stack buffer tempRFSECbuf using strcpy with no length check, across three separate code branches (DS10A/KR10A/MS10A device types).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-05

Last Modified

2026-08-10

Generated

2026-08-25

AI Q&A

2026-08-05

EPSS Evaluated

2026-08-24

NVD

CVE-2026-71265

EUVD

EUVD-2026-53350

Affected Vendors & Products

Vendor	Product	Version / Range
domoticz	domoticz	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-121	A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

Attack-Flow Graph

Executive Summary

This vulnerability is a stack-based buffer overflow in Domoticz's MochadTCP component. It occurs when the software copies network data into a fixed-size buffer without checking the length, allowing an attacker on the local network to send a specially crafted packet that overflows the buffer and corrupts the stack of Domoticz's worker thread.

Detection Guidance

Check if the Mochad TCP bridge (port 1099) is running on your network. Use network scanning tools like nmap to detect open ports: nmap -p 1099 <target_IP>. Monitor for unusual traffic patterns or crashes in Domoticz logs.

Impact Analysis

An attacker could exploit this to execute arbitrary code on the system running Domoticz, potentially gaining control over the device. This could lead to unauthorized access, data theft, or disruption of home automation systems managed by Domoticz.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Organizations using Domoticz in regulated environments may face compliance breaches if the system is compromised due to this flaw.

Mitigation Strategies

Immediately block external access to port 1099 using a firewall. Update Domoticz to the latest version if a patch is available. Disable the Mochad TCP bridge if not needed. Restrict network access to trusted devices only.

Hi! I’m here to help you understand CVE-2026-71265. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70