Out-of-bounds Read in Loytec LIP-ME201C and Other Products

Executive Summary

This vulnerability is an out-of-bounds read (CWE-125) in the BACnet packet parsing function bacdt_datetime_to_tod. It affects multiple Loytec devices running firmware versions up to 8.4.18. An unauthenticated remote attacker can exploit it by sending a malformed BACnet TimeSynchronization or UTC-TimeSynchronization packet with an invalid month value. This causes the device to crash due to reading outside the bounds of the bacdt_days_till_month lookup table.

Useful 0 Not Useful 0

Detection Guidance

Monitor network traffic for malformed BACnet TimeSynchronization or UTC-TimeSynchronization packets with invalid month values. Use packet inspection tools like Wireshark to filter for BACnet protocol traffic and check for unusual or malformed packets targeting port 47808 (default BACnet port).

Useful 0 Not Useful 0

Impact Analysis

The vulnerability allows an attacker to crash the linx_a64.exe process on affected devices, leading to a denial of service. While the process auto-restarts after each crash, repeated exploitation can disrupt device functions and eventually force a full device reboot. This can cause operational downtime in building management, automation, or control systems.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could impact compliance with standards like GDPR and HIPAA by enabling denial-of-service attacks that disrupt device availability. Repeated crashes of BACnet devices may lead to loss of control over building management systems, potentially violating availability requirements in these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade affected Loytec devices to firmware version 8.4.20 or later to address the out-of-bounds read vulnerability. Isolate vulnerable devices from untrusted networks until patched. Monitor device logs for repeated crashes of linx_a64.exe which may indicate exploitation attempts.

Useful 0 Not Useful 0