CVE-2022-24700
📋 TL;DR
A buffer overflow vulnerability in WinAPRS 2.9.0 allows remote attackers to crash the daemon by sending malicious AX.25 packets over VHF radio. This affects users running unsupported versions of WinAPRS for amateur radio packet communication. The vulnerability is specific to DIGI address processing in KISS packets.
💻 Affected Systems
- WinAPRS
📦 What is this software?
Winaprs by Winaprs
⚠️ Risk & Real-World Impact
Worst Case
Persistent denial of service rendering the WinAPRS service unavailable, potentially disrupting amateur radio packet communication networks.
Likely Case
Intermittent daemon crashes requiring manual restart, disrupting APRS packet forwarding and position reporting.
If Mitigated
No impact if vulnerable software is not exposed to malicious packet sources or if workarounds are implemented.
🎯 Exploit Status
Exploitation requires radio transmission capability but no authentication. Proof of concept demonstrated in referenced blog posts.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: N/A
Vendor Advisory: N/A
Restart Required: No
Instructions:
No official patch available as WinAPRS is no longer supported. Consider migrating to alternative APRS software.
🔧 Temporary Workarounds
Network Segmentation
allIsolate WinAPRS systems from untrusted radio sources using physical separation or trusted repeater networks only.
Monitoring and Restart Script
windowsImplement automated monitoring to detect crashes and restart the WinAPRS service.
🧯 If You Can't Patch
- Replace WinAPRS with actively maintained alternative APRS software
- Implement strict radio network controls to only accept packets from trusted sources
🔍 How to Verify
Check if Vulnerable:
Check WinAPRS version in Help > About menu. Version 2.9.0 is vulnerable.Check Version:
Check WinAPRS GUI: Help > AboutVerify Fix Applied:
Since no patch exists, verification involves confirming migration to alternative software or implementation of workarounds.📡 Detection & Monitoring
Log Indicators:
- WinAPRS service crash logs
- Unexpected termination events in Windows Event Viewer
Network Indicators:
- Unusual AX.25 packet patterns on VHF frequencies
- Malformed DIGI addresses in packet captures
SIEM Query:
EventID: 1000 OR 1001 Source: WinAPRS.exe (Windows Event Log)