PT-2024-30207 · Contemporary Controls · Basrouter

Iszzzzz · Published 2024-04-27 · Updated 2024-06-04 · CVE-2024-4292

Positive Technologies (AI Summary)

CVSS v2.0

6.1

Medium

Base vector

AV:A/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Contemporary Controls BASrouter BACnet BASRT-B version 2.7.2

Description A critical vulnerability has been found in the Device-Communication-Control Service component. The manipulation with the input 55ff0500370015f30104025506110afb7519035d0841e4bece257b6acfc71f leads to denial of service. The exploit has been disclosed to the public and may be used.

Recommendations For version 2.7.2, as a temporary workaround, consider disabling the Device-Communication-Control Service until a patch is available. Restrict access to the network to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Resource Release

Weakness Enumeration

CWE-404

Related Identifiers

CVE-2024-4292

Affected Products

Basrouter

References · 8

• 🔥❌ https://github.com/isZzzz/BASRT-B_BACnet_Router_Document/blob/main/BASER-B_backdoor.pcapng · Exploit, Deleted
• 🔥❌ https://github.com/isZzzz/BASRT-B_BACnet_Router_Document/blob/main/BASRT_CVE_apply.pdf · Exploit, Deleted
• https://nvd.nist.gov/vuln/detail/CVE-2024-4292 · Security Note
• https://vuldb.com/?ctiid.262224 · Note
• https://t.me/cvenotify/78254 · Telegram Post
• https://twitter.com/oktsec/status/1784803021102191069 · Twitter Post
• https://vuldb.com/?id.262224 · Note
• https://vuldb.com/?submit.320749 · Note