CVE-2026-18368 describes a heap-based buffer overflow vulnerability (CWE-122) in the modbusgwd service of Teltonika Networks RUTOS devices. The issue is due to improper handling of Modbus TCP request data, allowing a remote unauthenticated attacker with access to the service to trigger a buffer overflow. This can result in denial of service. The vulnerability is confirmed in RUTOS version 7.12.0. The CVSS v4.0 base score is 6.0, indicating medium severity. No known exploits in the wild or vendor remediation have been reported as of the published date.

Successful exploitation allows a remote attacker to cause a denial of service on affected RUTOS devices by triggering a heap-based buffer overflow in the modbusgwd service. There is no indication of privilege escalation, code execution, or data disclosure from the provided information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the Modbus TCP service to trusted networks only to reduce exposure.