Technical impact
The Domoticz MochadTCP::MatchLine handler processes MOCHAD_RFSEC messages by copying up to 1028 bytes of network‑received data from the m_mochadbuffer into a fixed 50‑byte stack buffer called tempRFSECbuf using strcpy without length checks. This occurs across three code branches for different device types (DS10A, KR10A, MS10A). The unchecked copy can overflow the stack, corrupt the worker thread’s stack frame, and potentially allow arbitrary code execution or denial of service. This is a classic stack buffer overflow, identified as CWE‑121.
Affected Systems
The vulnerability affects the Domoticz home automation software (domoticz:domoticz). Any deployment that has not applied the patch for this issue is susceptible; specific affected versions are not listed in the advisory, so the entire unpatched code base is at risk.
Risk and Exploitability
The CVSS score of 7.5 indicates a high severity of the flaw, and the attack requires an attacker to be on the same local network segment and reach the Mochad TCP bridge on the default port 1099, which has no authentication. The EPSS score of < 1% indicates a low but non‑zero likelihood of exploitation, but the lack of authentication and open port still allow potential attacks. The vulnerability is not currently listed in the CISA KEV catalog. An exploit would likely involve sending a crafted packet to overflow the buffer, corrupt stack memory, and then causing the worker thread to execute arbitrary code or crash.
