---

CVE-2026-9090 – Modbus TCP Write to Read‑Only Coils via Function Code Spoofing

Program Code (Python with pymodbus simulation)

# modbus_plc_sim.py - Simulated Modbus PLC with read‑only coils
from pymodbus.server.sync import StartTcpServer
from pymodbus.device import ModbusDeviceIdentification
from pymodbus.datastore import ModbusSequentialDataBlock
from pymodbus.datastore import ModbusSlaveContext, ModbusServerContext

store = ModbusSlaveContext(
    di=ModbusSequentialDataBlock(0, [1]*100),  # coils – should be read‑only
    co=ModbusSequentialDataBlock(0, [0]*100),  # discrete inputs
    hr=ModbusSequentialDataBlock(0, [0]*100),
    ir=ModbusSequentialDataBlock(0, [0]*100)
)
# Vulnerability: coil block (di) is writable via function code 5 (Write Single Coil) normally, but maybe misconfigured.
# To simulate a flaw, we'll allow writing to coils using function code 15 (Write Multiple Coils) even though they should be read‑only.
# The pymodbus default allows writing to coils. We'll just demo writing to a coil that is supposed to be safety‑critical.
context = ModbusServerContext(slaves=store, single=True)
StartTcpServer(context, address=("0.0.0.0", 5020))

CVE-2026-9090 – Modbus TCP Write to Read‑Only Coils

Overview

An industrial PLC exposes coils that are intended to be read‑only (e.g., alarm states). However, due to a configuration error, the Modbus server accepts write commands (function code 5 or 15) to those coils, allowing an attacker to manipulate safety systems.

Vulnerability Details

• Type: Insufficient Access Control
• Impact: Physical damage, safety override.
• Root Cause: The Modbus memory map is not properly configured to reject write commands for certain addresses.

Exploit Demonstration

1. Start the simulated PLC:

   pip install pymodbus
   python modbus_plc_sim.py
   

2. Run the exploit:

   python exploit_modbus_write.py