CVE-2018-10832

5.5 mediumEPSS 5.7%

Medium (5.5) in modbuspal project modbuspal. EPSS 5.7% chance of exploitation in the next 30 days.

ModbusPal 1.6b is vulnerable to an XML External Entity (XXE) attack. Projects are saved as .xmpp files and automations can be exported as .xmpa files, both XML-based, which are vulnerable to XXE injection. Sending a crafted .xmpp or .xmpa file to a user, when opened/imported in ModbusPal, will return the contents of any local files to a remote attacker.

Severity

CVSS 3.0

5.5 medium

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

EPSS: 5.7% chance of exploitation in the next 30 days; higher than 93% of CVEs (scores of 2026-10-31)
CWE: CWE-611
Published: 2018-05-11
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

modbuspal_project:modbuspal

References

http://packetstormsecurity.com/files/147573/ModbusPal-1.6b-XML-External-Entity-Injection.html
https://www.exploit-db.com/exploits/44607/
http://packetstormsecurity.com/files/147573/ModbusPal-1.6b-XML-External-Entity-Injection.html
https://www.exploit-db.com/exploits/44607/

Check your stack JSON