george0papasotiriou/cve-2026-9090-modbus-tcp-write-to-read-only-coils-via-function-code-spoofing시뮬레이션된 PLC에서 읽기 전용 코일(read-only coils)에 대한 스푸핑된 쓰기(spoofed writes)를 시연하여 SCADA/ICS 접근 제어 결함을 조명하는 PoC Modbus TCP 익스플로잇.
# modbus_plc_sim.py - Simulated Modbus PLC with read‑only coils
from pymodbus.server.sync import StartTcpServer
from pymodbus.device import ModbusDeviceIdentification
from pymodbus.datastore import ModbusSequentialDataBlock
from pymodbus.datastore import ModbusSlaveContext, ModbusServerContext
store = ModbusSlaveContext(
di=ModbusSequentialDataBlock(0, [1]*100), # coils – should be read‑only
co=ModbusSequentialDataBlock(0, [0]*100), # discrete inputs
hr=ModbusSequentialDataBlock(0, [0]*100),
ir=ModbusSequentialDataBlock(0, [0]*100)
)
# Vulnerability: coil block (di) is writable via function code 5 (Write Single Coil) normally, but maybe misconfigured.
# To simulate a flaw, we'll allow writing to coils using function code 15 (Write Multiple Coils) even though they should be read‑only.
# The pymodbus default allows writing to coils. We'll just demo writing to a coil that is supposed to be safety‑critical.
context = ModbusServerContext(slaves=store, single=True)
StartTcpServer(context, address=("0.0.0.0", 5020))
산업용 PLC가 읽기 전용으로 설계된 코일(예: 알람 상태)을 노출합니다. 그러나 구성 오류로 인해 Modbus 서버가 해당 코일에 대한 쓰기 명령(기능 코드 5 또는 15)을 수락하므로, 공격자가 안전 시스템을 조작할 수 있습니다.
pip install pymodbus
python modbus_plc_sim.py
python exploit_modbus_write.py