The vulnerability in Domoticz's MochadTCP::MatchLine() handler arises from unsafe use of strcpy() to copy network-received data from a buffer of up to 1028 bytes into a fixed 50-byte stack buffer (tempRFSECbuf) without length validation. This occurs in handling MOCHAD_RFSEC messages for DS10A, KR10A, and MS10A device types. The lack of bounds checking enables a local network attacker with access to the Mochad TCP bridge (default port 1099, which lacks authentication) to send a specially crafted packet that overflows the stack buffer by several hundred bytes, leading to stack corruption in the Domoticz worker thread. The CVSS 3.1 score is 7.5, reflecting high impact on confidentiality, integrity, and availability.

Successful exploitation allows an attacker on the local network segment to cause a stack-based buffer overflow in the Domoticz worker thread, potentially leading to arbitrary code execution, denial of service, or system compromise. The vulnerability affects confidentiality, integrity, and availability of the affected system components.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict network access to the Mochad TCP bridge port (default 1099) to trusted hosts only, as it lacks authentication. Monitor for updates from Domoticz regarding an official fix or mitigation.