CVE-2025-66624
📋 TL;DR
This vulnerability in the BACnet Protocol Stack library allows out-of-bounds memory reads when processing specially crafted BACnet network protocol data units (NPDUs). Systems using affected versions of the BACnet stack for building automation and control communications are vulnerable to denial of service (crash) and potential mis-routing of network replies.
💻 Affected Systems
- BACnet Protocol Stack library
- Any software using the BACnet-stack library
📦 What is this software?
Bacnet Stack by Bacnetstack
⚠️ Risk & Real-World Impact
Worst Case
Reliable denial of service causing system crashes on protected builds (ASan/MPU/strict), and undefined behavior including potential memory corruption or mis-routed network traffic on unprotected builds.
Likely Case
Denial of service through application crashes when processing malformed BACnet packets, disrupting building automation systems.
If Mitigated
Minimal impact if proper memory protection mechanisms (ASan, MPU) are enabled, causing controlled crashes instead of undefined behavior.
🎯 Exploit Status
Exploitation requires network access to BACnet ports (typically 47808/UDP). The advisory indicates only memory reads occur, making RCE unlikely but DoS reliable.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.5.0.rc2 and later
Vendor Advisory: https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-8wgw-5h6x-qgqg
Restart Required: Yes
Instructions:
1. Update BACnet-stack library to version 1.5.0.rc2 or later. 2. Rebuild any applications using the library. 3. Restart affected BACnet services or devices.
🔧 Temporary Workarounds
Network segmentation
allIsolate BACnet networks from untrusted networks using firewalls or VLANs.
Enable memory protection
linuxCompile applications with address sanitizer (ASan) or memory protection units (MPU) to convert undefined behavior into controlled crashes.
gcc -fsanitize=address -o bacnet_app bacnet_app.c
🧯 If You Can't Patch
- Implement strict network access controls to BACnet ports (47808/UDP) allowing only trusted devices.
- Monitor for abnormal BACnet traffic patterns or repeated crashes of BACnet services.
🔍 How to Verify
Check if Vulnerable:
Check if BACnet-stack library version is earlier than 1.5.0.rc2 in application dependencies or linked libraries.Check Version:
Check library version in source code or use: strings libbacnet.so | grep BACNET_STACK_VERSIONVerify Fix Applied:
Verify BACnet-stack library version is 1.5.0.rc2 or later and applications have been rebuilt with the updated library.📡 Detection & Monitoring
Log Indicators:
- Application crashes or segmentation faults in BACnet services
- Error logs mentioning out-of-bounds memory access
Network Indicators:
- Unusual BACnet NPDU packets smaller than expected
- Traffic to BACnet port 47808/UDP from unexpected sources
SIEM Query:
source="bacnet.log" AND ("segmentation fault" OR "out of bounds" OR "crash")