george0papasotiriou/cve-2026-9090-modbus-tcp-write-to-read-only-coils-via-function-code-spoofingExploit PoC Modbus TCP que demonstra escritas falsificadas em bobinas somente leitura em CLPs simulados, evidenciando falhas de controle de acesso em SCADA/ICS.
# modbus_plc_sim.py - Simulated Modbus PLC with read‑only coils
from pymodbus.server.sync import StartTcpServer
from pymodbus.device import ModbusDeviceIdentification
from pymodbus.datastore import ModbusSequentialDataBlock
from pymodbus.datastore import ModbusSlaveContext, ModbusServerContext
store = ModbusSlaveContext(
di=ModbusSequentialDataBlock(0, [1]*100), # coils – should be read‑only
co=ModbusSequentialDataBlock(0, [0]*100), # discrete inputs
hr=ModbusSequentialDataBlock(0, [0]*100),
ir=ModbusSequentialDataBlock(0, [0]*100)
)
# Vulnerability: coil block (di) is writable via function code 5 (Write Single Coil) normally, but maybe misconfigured.
# To simulate a flaw, we'll allow writing to coils using function code 15 (Write Multiple Coils) even though they should be read‑only.
# The pymodbus default allows writing to coils. We'll just demo writing to a coil that is supposed to be safety‑critical.
context = ModbusServerContext(slaves=store, single=True)
StartTcpServer(context, address=("0.0.0.0", 5020))
Um PLC industrial expõe bobinas que devem ser somente de leitura (por exemplo, estados de alarme). No entanto, devido a um erro de configuração, o servidor Modbus aceita comandos de escrita (código de função 5 ou 15) para essas bobinas, permitindo que um atacante manipule sistemas de segurança.
pip install pymodbus
python modbus_plc_sim.py
python exploit_modbus_write.py