CVE-2022-4857

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

A vulnerability was found in Modbus Tools Modbus Poll up to 9.10.0 and classified as critical. Affected by this issue is some unknown functionality of the file mbpoll.exe of the component mbp File Handler. The manipulation leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-217022 is the identifier assigned to this vulnerability.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-120

Affected software

Vendor	Product	Versions
Modbus Tools	Modbus Poll	9.0; 9.1; 9.2; 9.3; 9.4; 9.5; 9.6; 9.7; 9.8; 9.9; 9.10

References

https://github.com/Durian1546/vul/blob/main/webray.com.cn/Modbus%20Poll/Modbus%20Poll%20(version%209.10.0%20and%20earlier)%20mbp%20file%20has%20a%20buffer%20overflow%20vulnerability.mdExploit, Patch, Third Party Advisory
https://github.com/Durian1546/vul/blob/main/webray.com.cn/Modbus%20Poll/poc/poc.mbpThird Party Advisory
https://vuldb.com/?ctiid.217022Third Party Advisory
https://vuldb.com/?id.217022Third Party Advisory
https://github.com/Durian1546/vul/blob/main/webray.com.cn/Modbus%20Poll/Modbus%20Poll%20(version%209.10.0%20and%20earlier)%20mbp%20file%20has%20a%20buffer%20overflow%20vulnerability.mdExploit, Patch, Third Party Advisory
https://github.com/Durian1546/vul/blob/main/webray.com.cn/Modbus%20Poll/poc/poc.mbpThird Party Advisory
https://vuldb.com/?ctiid.217022Third Party Advisory
https://vuldb.com/?id.217022Third Party Advisory

Timeline

Published: Dec 30, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-485707.5Crypto++ through 8.4 contains a timing side channel in ECDSA signature generation. Function FixedSizeAllocatorWithCleanup could write to mem CVE-2022-485717.5memcached 1.6.7 allows a Denial of Service via multi-packet uploads in UDP.CVE-2022-485753.5A person with access to a Mac may be able to bypass Login Window. A consistency issue was addressed with improved state handling. This issue CVE-2022-485775.5An access issue was addressed with improved access restrictions. This issue is fixed in macOS Ventura 13. An app may be able to access user-CVE-2022-485787.1An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Monterey 12.5. Processing an AppleScript may CVE-2022-485797.5UnRAR before 6.2.3 allows extraction of files outside of the destination folder via symlink chains.CVE-2022-48587.5Insertion of Sensitive Information into Log Files in M-Files Server before 22.10.11846.0 could allow to obtain sensitive tokens from logs, i CVE-2022-485808.8A command injection vulnerability exists in the ARP ping device tool feature of the ScienceLogic SL1 that takes unsanitized user controlled CVE-2022-485818.8A command injection vulnerability exists in the “dash export” feature of the ScienceLogic SL1 that takes unsanitized user controlled input a CVE-2022-485828.8A command injection vulnerability exists in the ticket report generate feature of the ScienceLogic SL1 that takes unsanitized user controlle CVE-2022-485838.8A command injection vulnerability exists in the dashboard scheduler feature of the ScienceLogic SL1 that takes unsanitized user‐controlled i CVE-2022-485848.8A command injection vulnerability exists in the download and convert report feature of the ScienceLogic SL1 that takes unsanitized user‐cont