GHSA-vrpm-9gm2-x552: BACnet Stack: Stack buffer overflow in Loop internal ReadProperty path via Life_Safety_Zone.accepted-modes on the default BACnet/IP server
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.4, 1.5.1, and 1.6.0, the current master demo server can be crashed remotely over BACnet/IP by sending a valid Confirmed WriteProperty request that updates loop-1's controlled-variable-reference to point to life-safety-zone-1 / accepted-modes. This issue has been patched in versions 1.4.4, 1.5.1, and 1.6.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
BACnet Stackto a version that resolves this vulnerability.Fixed in 1.4.4 - Upgrade
Upgrade
BACnet Stackto a version that resolves this vulnerability.Fixed in 1.5.1 - Upgrade
Upgrade
BACnet Stackto a version that resolves this vulnerability.Fixed in 1.6.0
Event History
Frequently Asked Questions
Which deployments are exposed to remote exploitation?
The current master demo server using BACnet/IP is exposed. An unauthenticated remote attacker can reach the vulnerable path over BACnet/IP.
What request is required to trigger the crash?
An attacker must send a valid Confirmed WriteProperty request that changes loop-1's controlled-variable-reference to life-safety-zone-1 / accepted-modes.
Are affected releases fixed?
The issue is patched in versions 1.4.4, 1.5.1, and 1.6.0. Versions prior to those releases are affected.