Unauthenticated Input Injection in ModbusServer via MQTT

CVE-2026-44092 represents a critical input validation failure in ModbusServer applications that consume data from MQTT message brokers. An unauthenticated attacker can inject malicious payloads through MQTT without requiring authentication, exploiting the application's failure to sanitize or validate incoming data. This vulnerability affects industrial control systems and IoT deployments relying on ModbusServer for protocol translation and device communication. The attack directly impacts system integrity (data tampering) and availability (service disruption), with a CVSS score of 9.1 reflecting its severity in operational technology environments where such systems often lack compensating controls.

While this CVE lacks specific MITRE ATT&CK technique mappings, Casky's extended reasoning capabilities would correlate this vulnerability pattern to techniques including T1190 (Exploit Public-Facing Application), T1200 (Hardware Additions), and T1657 (Defacement) through detection of unauthenticated network access and data manipulation attempts. Practitioners using Casky would observe findings centered on CWE-93 (Improper Neutralization of Different Encoding) detection, identifying suspicious MQTT message payloads that bypass input validation filters. The platform's skill mapping would surface defensive recommendations including MQTT broker authentication enforcement, input sanitization rules, network segmentation of OT systems, and application-layer validation logic—enabling teams to map detection and prevention strategies even when ATT&CK technique specificity is unavailable.