CVE-2024-52288
📋 TL;DR
This vulnerability in libosdp allows man-in-the-middle attackers to capture and replay OSDP protocol messages, potentially enabling unauthorized access to physical access control systems. It affects systems using vulnerable versions of libosdp for communication between control panels and peripheral devices.
💻 Affected Systems
- libosdp
⚠️ Manual Verification Required
This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.
Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).
🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.
- Review the CVE details at NVD
- Check vendor security advisories for your specific version
- Test if the vulnerability is exploitable in your environment
- Consider updating to the latest version as a precaution
⚠️ Risk & Real-World Impact
Worst Case
Attacker gains unauthorized physical access by replaying valid authentication messages to bypass door access controls
Likely Case
Temporary disruption of access control systems or unauthorized entry to controlled areas
If Mitigated
Limited impact due to network segmentation and physical security controls
🎯 Exploit Status
Requires MITM position and timing coordination, but detailed advisory provides exploitation methodology
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.0.0
Vendor Advisory: https://github.com/goToMain/libosdp/security/advisories/GHSA-xhjw-7vh5-qxqm
Restart Required: Yes
Instructions:
1. Identify systems using libosdp. 2. Update to version 3.0.0 or later. 3. Restart affected services. 4. Verify the fix using version check.
🧯 If You Can't Patch
- Implement network segmentation to isolate OSDP traffic from untrusted networks
- Deploy physical security monitoring to detect unauthorized access attempts
🔍 How to Verify
Check if Vulnerable:
Check libosdp version - if below 3.0.0, system is vulnerableCheck Version:
Check application documentation or build configuration for libosdp versionVerify Fix Applied:
Confirm libosdp version is 3.0.0 or higher and check for commit 298576d9 in source📡 Detection & Monitoring
Log Indicators:
- Unexpected RMAC_I or REPLY_CCRYPT messages
- Session resets or anomalies in OSDP protocol logs
Network Indicators:
- Repeated OSDP message patterns
- Unusual timing in OSDP protocol exchanges
SIEM Query:
Search for OSDP protocol anomalies or repeated authentication messages within short timeframes