CVE-2022-24702
📋 TL;DR
CVE-2022-24702 is a critical buffer overflow vulnerability in WinAPRS 2.9.0's VHF KISS TNC component that allows remote code execution via malicious AX.25 packets transmitted over radio frequencies. This affects amateur radio operators and organizations using WinAPRS for APRS (Automatic Packet Reporting System) communications, particularly those with exposed radio interfaces. The software is no longer supported by the maintainer, increasing the risk for remaining users.
💻 Affected Systems
- WinAPRS
📦 What is this software?
Winaprs by Winaprs
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with attacker gaining complete control over the WinAPRS host system, potentially enabling lateral movement within networks and persistent access.
Likely Case
Remote code execution leading to system compromise, data theft, or use as a pivot point for further attacks within connected networks.
If Mitigated
Limited impact if system is isolated from critical networks and runs with minimal privileges, though RCE would still compromise the WinAPRS system itself.
🎯 Exploit Status
Exploits are publicly available on GitHub. Attack requires ability to transmit malicious AX.25 packets over radio frequencies to the target system.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: None
Vendor Advisory: https://winaprs.com/
Restart Required: No
Instructions:
No official patch available. Software is no longer supported. Consider migrating to alternative APRS software solutions.
🔧 Temporary Workarounds
Network Segmentation
allIsolate WinAPRS systems from critical networks using firewalls or air gaps
Disable VHF KISS TNC
windowsDisable or remove the vulnerable VHF KISS TNC component if not required
🧯 If You Can't Patch
- Replace WinAPRS with supported alternative APRS software
- Implement strict network segmentation and monitor for suspicious radio traffic
🔍 How to Verify
Check if Vulnerable:
Check WinAPRS version via Help > About menu. Version 2.9.0 is vulnerable.Check Version:
Check WinAPRS GUI: Help > AboutVerify Fix Applied:
No fix available to verify. Consider verifying removal or replacement of WinAPRS software.📡 Detection & Monitoring
Log Indicators:
- Unusual process creation from WinAPRS.exe
- Abnormal network connections from WinAPRS host
Network Indicators:
- Suspicious AX.25 packet patterns on radio interfaces
- Unexpected outbound connections from WinAPRS systems
SIEM Query:
Process Creation where Image contains 'WinAPRS.exe' AND ParentImage not in ('expected_parents')🔗 References
- https://github.com/Coalfire-Research/WinAPRS-Exploits
- https://news.ycombinator.com/item?id=31571476
- https://winaprs.com/
- https://www.coalfire.com/the-coalfire-blog/hacking-ham-radio-winaprs-part1
- https://github.com/Coalfire-Research/WinAPRS-Exploits
- https://news.ycombinator.com/item?id=31571476
- https://winaprs.com/
- https://www.coalfire.com/the-coalfire-blog/hacking-ham-radio-winaprs-part1
