CVE-2026-71265 Overview
CVE-2026-71265 is a stack-based buffer overflow [CWE-121] in the Domoticz home automation server. The flaw resides in the MochadTCP::MatchLine() handler within hardware/MochadTCP.cpp, which processes MOCHAD_RFSEC messages from the Mochad TCP bridge. The handler copies attacker-controlled data from the 1028-byte m_mochadbuffer into a fixed 50-byte stack buffer named tempRFSECbuf using strcpy() without bounds checking. An attacker on the adjacent network can reach the Mochad bridge (default port 1099, no authentication) and send a crafted packet that overflows the stack by several hundred bytes.
Critical Impact
Unauthenticated adjacent-network attackers can corrupt the Domoticz worker thread's stack, leading to denial of service or potential code execution.
Affected Products
- Domoticz home automation server
- hardware/MochadTCP.cpp component handling Mochad TCP bridge messages
- Deployments exposing the Mochad bridge on the local network (default TCP port 1099)
Discovery Timeline
- 2026-08-05 - CVE-2026-71265 published to NVD
- 2026-08-05 - Last updated in NVD database
Technical Details for CVE-2026-71265
Vulnerability Analysis
The vulnerability originates in the MochadTCP::MatchLine() function inside hardware/MochadTCP.cpp. This function parses inbound MOCHAD_RFSEC messages received from the Mochad TCP bridge. Domoticz buffers up to 1028 bytes of network data in m_mochadbuffer before dispatching parsing routines.
Within three separate code branches handling DS10A, KR10A, and MS10A device types, the code invokes strcpy() to copy data from m_mochadbuffer into a fixed 50-byte stack buffer named tempRFSECbuf. No length validation occurs before the copy. When the source data exceeds 50 bytes, strcpy() writes past the destination buffer and corrupts the surrounding stack frame of the Domoticz worker thread.
Because the Mochad TCP bridge listens on port 1099 without authentication, any host on the local network segment can trigger the overflow. The corruption can overwrite saved return addresses, frame pointers, and adjacent local variables, enabling denial of service and, depending on stack protections, potential code execution in the context of the Domoticz service.
Root Cause
The root cause is unsafe use of strcpy() in place of a bounds-checked copy such as strncpy() or strlcpy(). The developer assumed that MOCHAD_RFSEC messages would remain small, but the parser accepts data from a 1028-byte network buffer into a 50-byte stack destination. This mismatch, combined with the absence of prior length validation, produces a classic stack-based buffer overflow [CWE-121].
Attack Vector
The attack requires network adjacency to the Domoticz host. An attacker connects to TCP port 1099 or impersonates the Mochad bridge, then sends a crafted MOCHAD_RFSEC message that references one of the vulnerable device type branches (DS10A, KR10A, or MS10A) with an oversized payload. No credentials or user interaction are required. The overflowed data lands directly on the worker thread's stack.
No verified public exploit code is available. See the Domoticz project source and the MochadTCP handler for the affected implementation.
Detection Methods for CVE-2026-71265
Indicators of Compromise
- Unexpected termination or repeated restarts of the Domoticz service or worker threads.
- Anomalous inbound TCP connections to port 1099 originating from hosts other than the legitimate Mochad bridge.
- MOCHAD_RFSEC messages containing DS10A, KR10A, or MS10A device identifiers with payloads exceeding typical short-frame lengths.
Detection Strategies
- Deploy network monitoring rules that flag oversized payloads directed to TCP port 1099 on Domoticz hosts.
- Enable core-dump collection on Domoticz servers to capture stack corruption artifacts for post-incident analysis.
- Correlate service crash events with recent network activity to the Mochad bridge port.
Monitoring Recommendations
- Log all connections to the Mochad TCP bridge and alert on sources outside an approved allowlist.
- Monitor Domoticz process health and generate alerts on abnormal exits or segmentation faults.
- Baseline expected MOCHAD_RFSEC message sizes and alert on statistical outliers.
How to Mitigate CVE-2026-71265
Immediate Actions Required
- Restrict access to TCP port 1099 to the specific IP address of the legitimate Mochad bridge using host or network firewall rules.
- Isolate Domoticz and its associated home-automation devices on a dedicated VLAN segregated from user and guest networks.
- Review the upstream Domoticz repository for commits addressing the MochadTCP::MatchLine() handler and apply once available.
Patch Information
At the time of publication, no fixed release is referenced in the NVD entry. Administrators should track the Domoticz GitHub repository for updates to hardware/MochadTCP.cpp that replace the unsafe strcpy() calls with bounds-checked copies.
Workarounds
- Disable the Mochad TCP hardware integration in the Domoticz web interface if it is not required.
- Bind the Domoticz Mochad client to a loopback or management interface only.
- Enforce network access control lists that permit only the trusted Mochad bridge host to reach port 1099.
- Run Domoticz under a restricted service account with stack protections (-fstack-protector-strong, ASLR, and non-executable stack) enabled at build time.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
