CVE-2024-12654
📋 TL;DR
This vulnerability in FabulaTech USB over Network allows local attackers to trigger a null pointer dereference in the ftusbbus2.sys driver via a specific IOCTL handler, potentially causing denial of service. It affects users of USB over Network Client software version 6.0.6.1. Exploitation requires local access to the system.
💻 Affected Systems
- FabulaTech USB over Network Client
📦 What is this software?
Usb Over Network by Fabulatech
⚠️ Risk & Real-World Impact
Worst Case
System crash or blue screen (BSOD) leading to denial of service and potential data loss from unsaved work.
Likely Case
Application crash or system instability requiring reboot, disrupting USB over Network functionality.
If Mitigated
Minimal impact if proper access controls prevent unauthorized local execution.
🎯 Exploit Status
Exploit requires local execution privileges. Public disclosure includes technical details that could facilitate exploitation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Vendor was contacted but did not respond. Consider upgrading to newer versions if available or using workarounds.
🔧 Temporary Workarounds
Restrict driver access
windowsModify permissions on ftusbbus2.sys to prevent unauthorized access
icacls "C:\Windows\System32\drivers\ftusbbus2.sys" /deny Everyone:(R,W,X)
Uninstall vulnerable software
windowsRemove FabulaTech USB over Network Client if not required
Control Panel > Programs > Uninstall a program > Select 'USB over Network Client' > Uninstall
🧯 If You Can't Patch
- Implement strict local access controls to prevent unauthorized users from executing code on affected systems.
- Monitor for crash dumps or system instability events related to ftusbbus2.sys driver.
🔍 How to Verify
Check if Vulnerable:
Check if ftusbbus2.sys driver version 6.0.6.1 is present in system drivers directory.Check Version:
powershell Get-Item "C:\Windows\System32\drivers\ftusbbus2.sys" | Select-Object VersionInfoVerify Fix Applied:
Verify ftusbbus2.sys driver has been removed or permissions have been restricted.📡 Detection & Monitoring
Log Indicators:
- System crash logs (Event ID 1001) referencing ftusbbus2.sys
- Application error logs showing access violations in USB over Network processes
Network Indicators:
- None - this is a local vulnerability
SIEM Query:
EventID=1001 AND Source="Windows Error Reporting" AND Description="*ftusbbus2.sys*"