CVE-2026-71265 in Domoticz
Summary
by MITRE • 08/05/2026
Domoticz's MochadTCP::MatchLine() handler for MOCHAD_RFSEC messages (hardware/MochadTCP.cpp) copies network-received data from the up-to-1028-byte m_mochadbuffer into a fixed 50-byte stack buffer tempRFSECbuf using strcpy() with no length check, across three separate code branches (DS10A/KR10A/MS10A device types). An attacker on the local network segment able to reach the Mochad TCP bridge (default port 1099, no authentication) can send a crafted packet that overflows tempRFSECbuf by up to several hundred bytes, corrupting the Domoticz worker thread's stack.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/05/2026
The vulnerability exists within Domoticz's MochadTCP::MatchLine() function which processes MOCHAD_RFSEC messages received through the network interface. This handler operates on hardware/MochadTCP.cpp and specifically targets three device types: DS10A/KR10A/MS10A, each requiring distinct processing branches. The flaw manifests when network-received data up to 1028 bytes from m_mochadbuffer is copied into a fixed 50-byte stack buffer named tempRFSECbuf using the unsafe strcpy() function without any bounds checking or length validation.
The security implications are severe as this creates a classic stack-based buffer overflow condition that can be exploited by attackers within the local network segment who can reach the Mochad TCP bridge service. The default port 1099 serves as the attack surface with no authentication requirements, making the vulnerability readily accessible to potential adversaries. The overflow occurs across three separate code branches, increasing the attack surface and exploitability factors.
This vulnerability directly maps to CWE-121 Stack-based Buffer Overflow, which is categorized under the common weakness enumeration framework for buffer overflows that occur in stack memory regions. The flaw enables attackers to overwrite adjacent stack memory locations including return addresses, function pointers, and local variables, potentially leading to arbitrary code execution within the Domoticz worker thread context. The attack requires minimal privileges since only network access to the TCP bridge is needed.
The operational impact extends beyond simple code execution as this vulnerability affects the core networking functionality of Domoticz's hardware integration layer. The affected system processes RF security messages for various device types, making it a critical component in home automation security systems where reliability and integrity are paramount. The memory corruption can cause unpredictable behavior including application crashes, data corruption, or complete system compromise depending on successful exploitation.
Mitigation strategies should focus on immediate code-level fixes including implementing proper bounds checking before string operations, using safe string handling functions such as strncpy() or strlcpy(), and validating input lengths against buffer sizes. Network segmentation and access control measures are essential including firewall rules restricting port 1099 access to trusted hosts only, implementing authentication mechanisms, and considering network isolation of the Domoticz system from general network traffic. The solution aligns with ATT&CK technique T1210 for exploitation of remote services and T1071.004 for application layer protocols involving TCP communications. Additionally, input validation should be strengthened to prevent any buffer overflow scenarios regardless of device type or message format.