CVE-2018-10832: Modbuspal Project Modbuspal

Medium severity, CVSS 5.5. EPSS: 5.8% chance of exploitation in the next 30 days.

ModbusPal 1.6b is vulnerable to an XML External Entity (XXE) attack. Projects are saved as .xmpp files and automations can be exported as .xmpa files, both XML-based, which are vulnerable to XXE injection. Sending a crafted .xmpp or .xmpa file to a user, when opened/imported in ModbusPal, will return the contents of any local files to a remote attacker.

Affected products

• Modbuspal Project Modbuspal: version 1.6 only

Published 2018-05-11. Last modified 2026-06-17.