From 20fd4e695873c902585fec2a7ac42d38cf20e85b Mon Sep 17 00:00:00 2001 From: jan iversen Date: Tue, 25 Aug 2026 09:33:44 +0200 Subject: [PATCH 1/2] Create SECURITY.md --- SECURITY.md | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) create mode 100644 SECURITY.md diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 000000000..6b892271c --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,18 @@ +# Security Policy + +## Supported Versions + +Only the latest version are supported. + +## Reporting a Vulnerability + +Please be aware that ModbusTcpServer, ModbusUdpServer, ModbusSimulatorServer as well as AsyncModbusTcpClient, +modbusTcpClient, AsyncModbusUdpClient, modbusUdpClient are not safe to be used on non-private networks. This is pr +modbus standard. Security reports telling they are not safe, are not accepted because it is a non-valid usage. + +For non-private networks please use ModbusTlsServer, AsyncModbusTlsClient or modbusTlsClient. Using the correct +certificate is an app issue and considered out of scope for pymodbus. The App can choose to e.g. use a +self-signed certificates which are considered insecure. + +Most vulnerabilities like e.g. a buffer overrun should just be reported as a normal issue, since it really is a bug, +allowing all users to be aware of the problem. From 52d09aaff08bcbaea0e3f32f31840bd814a428d2 Mon Sep 17 00:00:00 2001 From: jan iversen Date: Tue, 25 Aug 2026 09:40:13 +0200 Subject: [PATCH 2/2] Update SECURITY.md --- SECURITY.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index 6b892271c..7fb7382fb 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -7,10 +7,10 @@ Only the latest version are supported. ## Reporting a Vulnerability Please be aware that ModbusTcpServer, ModbusUdpServer, ModbusSimulatorServer as well as AsyncModbusTcpClient, -modbusTcpClient, AsyncModbusUdpClient, modbusUdpClient are not safe to be used on non-private networks. This is pr +ModbusTcpClient, AsyncModbusUdpClient, ModbusUdpClient are not safe to be used on non-private networks. This is pr modbus standard. Security reports telling they are not safe, are not accepted because it is a non-valid usage. -For non-private networks please use ModbusTlsServer, AsyncModbusTlsClient or modbusTlsClient. Using the correct +For non-private networks please use ModbusTlsServer, AsyncModbusTlsClient or ;odbusTlsClient. Using the correct certificate is an app issue and considered out of scope for pymodbus. The App can choose to e.g. use a self-signed certificates which are considered insecure.