SearchSubscribe

TRA-2026-34

Denial of service in Modbus gateway parser

A malformed function code sends the gateway's parser into an unbounded loop until a watchdog reset.

  • Patched
  • OT & ICS

CVSS 3.1 base score

5.9medium

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Vendor
Quanta Automation
Product
Q-Link Gateway
CVE
  • CVE-2026-32716
Disclosure
90 days
Researchers
Yuki Tanaka

Score breakdown

Exploitability

Attack vector
Attack complexity
Privileges required
User interaction

Scope

Scope

Impact

Confidentiality
Integrity
Availability

Affected products

ProductAffectedFixed in
Q-Link Gateway2.3 – 2.8.02.8.1

Questions about this advisory

research@tenable.com
On this page6 sections
  1. Score breakdown
  2. Affected products
  3. Synopsis
  4. Proof of concept
  5. Solution
  6. Disclosure timeline

Synopsis

A malformed function code sends the gateway’s parser into an unbounded loop until a watchdog reset.

Proof of concept

Tenable has shared a proof of concept with Quanta Automation. It is not published here, to give operators time to apply the fix.

Solution

Upgrade to 2.8.1 or later. Filtering unknown Modbus function codes at the network edge also prevents the issue.

Disclosure timeline

  1. Tenable reports the issue to Quanta Automation

  2. TRA-2026-34 published

90 days from report to publication, against a 90-day policy.How we disclose