CVE-2024-25393
📋 TL;DR
A stack buffer overflow vulnerability in RT-Thread's AT command server component allows remote code execution. This affects all systems running RT-Thread RTOS with AT server functionality enabled. Attackers can exploit this to take complete control of affected devices.
💻 Affected Systems
- RT-Thread Real-Time Operating System
📦 What is this software?
Rt Thread by Rt Thread
⚠️ Risk & Real-World Impact
Worst Case
Remote unauthenticated attacker gains full system control, executes arbitrary code, and potentially pivots to other network devices.
Likely Case
Remote code execution leading to device compromise, data theft, or integration into botnets.
If Mitigated
Denial of service or system instability if exploit attempts are blocked but successful execution is prevented.
🎯 Exploit Status
Technical details and proof-of-concept are publicly available. The vulnerability is straightforward to exploit given its stack buffer overflow nature.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.0.3 and later
Vendor Advisory: https://github.com/RT-Thread/rt-thread/issues/8288
Restart Required: Yes
Instructions:
1. Update RT-Thread to version 5.0.3 or later. 2. Rebuild and redeploy the firmware. 3. Restart affected devices.
🔧 Temporary Workarounds
Disable AT Server
allDisable the vulnerable AT server component if not required for device functionality.
Disable AT_SERVER in RT-Thread configuration (menuconfig or Kconfig)
Network Segmentation
allIsolate devices with AT server functionality from untrusted networks.
Implement firewall rules to restrict access to AT server ports
🧯 If You Can't Patch
- Implement strict network access controls to limit who can communicate with AT server ports
- Deploy intrusion detection/prevention systems to monitor for buffer overflow attempts
🔍 How to Verify
Check if Vulnerable:
Check RT-Thread version and verify AT server is enabled in configuration.Check Version:
Check RT-Thread version in source code or firmware metadataVerify Fix Applied:
Verify RT-Thread version is 5.0.3 or later and review source code for proper bounds checking in net/at/src/at_server.c.📡 Detection & Monitoring
Log Indicators:
- AT server crash logs
- Stack corruption warnings
- Unexpected device reboots
Network Indicators:
- Unusual traffic patterns to AT server ports
- Malformed AT commands exceeding expected length
SIEM Query:
Search for: 'AT server crash' OR 'stack overflow' OR device_id IN (list_of_rt_thread_devices) AND (unexpected_restart OR memory_error)🔗 References
- http://www.openwall.com/lists/oss-security/2024/03/05/1
- https://github.com/RT-Thread/rt-thread/issues/8288
- https://github.com/hnsecurity/vulns/blob/main/HNS-2024-05-rt-thread.txt
- https://seclists.org/fulldisclosure/2024/Mar/28
- https://security.humanativaspa.it/multiple-vulnerabilities-in-rt-thread-rtos/
- http://seclists.org/fulldisclosure/2024/Mar/28
- http://www.openwall.com/lists/oss-security/2024/03/05/1
- https://github.com/RT-Thread/rt-thread/issues/8288
- https://github.com/hnsecurity/vulns/blob/main/HNS-2024-05-rt-thread.txt
- https://seclists.org/fulldisclosure/2024/Mar/28
- https://security.humanativaspa.it/multiple-vulnerabilities-in-rt-thread-rtos/
