Out-of-Bounds Read in BACnet Stack via BACnet/IP UDP

Executive Summary

This vulnerability is an out-of-bounds read issue in the BACnet Stack library affecting versions before 1.4.5, 1.5.1, and 1.6.0. A single unauthenticated BACnet/IP UDP datagram sent to port 47808 can trigger this flaw in the xy_color_decode() function. The issue is reachable pre-authentication through two default service handlers: UnconfirmedRequest WriteGroup service and Confirmed WriteProperty on a BACnetXYColor-typed property.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires monitoring for unauthenticated BACnet/IP UDP traffic on port 47808. Use network scanning tools like nmap to check for open BACnet ports. Inspect BACnet service handlers for WriteGroup (0x0A) or WriteProperty on BACnetXYColor properties. Check if the BACnet Stack version is below 1.4.5, 1.5.1, or 1.6.0.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could allow an attacker to cause a denial of service by crashing the affected system due to the out-of-bounds read. It does not lead to data exposure or privilege escalation but may disrupt operations relying on the BACnet Stack library.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update the BACnet Stack to version 1.4.5, 1.5.1, or 1.6.0 or later. Block unauthenticated BACnet/IP UDP traffic on port 47808 at the network firewall. Disable or restrict access to the WriteGroup service and WriteProperty on BACnetXYColor properties if not required.

Useful 0 Not Useful 0