George0Papasotiriou/CVE-2026-9090-Modbus-TCP-Write-to-Read-Only-Coils-via-Function-Code-Spoofing

GitHubRepository PoCExploit

PoC files

4 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact contains a Python script (exploit_modbus_write.py) that uses pymodbus to write to a coil on a simulated Modbus TCP server, intended to demonstrate unauthorized modification of read-only coils. A companion script (modbus_plc_sim.py) simulates the vulnerable server.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a README and a Python exploit script for a Modbus TCP vulnerability. The README describes a configuration error allowing writes to read-only coils, and the exploit script demonstrates a legitimate proof-of-concept write to a coil. No backdoor, concealed executable behavior, or operator-directed harm is present in the reviewed text.

ClassificationExploit
Model confidence95%
AuthenticationNot required
LanguagesPython
Target softwareModbus TCP Serverpymodbus
Attack typesInsufficient Access ControlProtocol Manipulation
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The file exploit_modbus_write.py is explicitly named as an exploit and contains code that actively sends a write command to a coil intended to be read-only, exercising the described vulnerability.

exploit_modbus_write.py:1-9README.md:41-48

Requirements

  • A running instance of the simulated Modbus TCP server (modbus_plc_sim.py) on localhost port 5020.README.md:42-45
  • The pymodbus Python library must be installed.README.md:44

Observed behavior

  • Connects to a Modbus TCP server at 127.0.0.1:5020 and sends a write command to coil 0, setting its value to False.exploit_modbus_write.py:4-7
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Vulnerability Description
CVE-2026-9090 is described as a Casdoor SAML authentication bypass, but the repository content describes a Modbus TCP write-to-read-only-coils vulnerability.The CVE metadata associated with the artifact does not match the vulnerability described in the repository files. This discrepancy is noted but does not constitute backdoor behavior within the artifact itself.README.md:4README.md:34
Review boundaries

What the analysis did not establish

  • The artifact's CVE context (CVE-2026-9090) describes a Casdoor SAML authentication bypass, which is unrelated to the Modbus TCP content in the repository files. This discrepancy suggests the repository may be mislabeled or the CVE association is incorrect.
  • The simulated server script (modbus_plc_sim.py) is only partially shown in README.md; the complete file is not provided in the selected text, limiting full verification of the vulnerable configuration.
  • The analysis is based solely on static code review; the code was not executed, and its actual behavior is not confirmed.
  • Two text files (total 4 files) were omitted from the packet content and were not reviewed.
  • Binary content was not analyzed; the packet policy is FLAGGED_METADATA_ONLY_NOT_ANALYZED.
  • The review is limited to the supplied evidence and does not assess the correctness or safety of the vulnerability demonstration.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1