« Volver al listado

CVE-2024-4292

Estado: AplazadaMedia (6.5)—

A vulnerability classified as critical has been found in Contemporary Controls BASrouter BACnet BASRT-B 2.7.2. Affected is an unknown function of the component Device-Communication-Control Service. The manipulation with the input 55ff0500370015f30104025506110afb7519035d0841e4bece257b6acfc71f leads to denial of service. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-262224. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Contemporary Controls — Basrouter Bacnet Basrt-bAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-4292",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-4292",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-05-01T19:00:03.368307Z"
        }
      }
    ],
    "cvssMetricV2": [
      {
        "type": "Secondary",
        "source": "cna@vuldb.com",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.1,
          "accessVector": "ADJACENT_NETWORK",
          "vectorString": "AV:A/AC:L/Au:N/C:N/I:N/A:C",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 6.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 6.5,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "cna@vuldb.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "ADJACENT_NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cna@vuldb.com",
      "affectedData": [
        {
          "vendor": "Contemporary Controls",
          "modules": [
            "Device-Communication-Control Service"
          ],
          "product": "BASrouter BACnet BASRT-B",
          "versions": [
            {
              "status": "affected",
              "version": "2.7.2"
            }
          ]
        }
      ]
    }
  ],
  "published": "2024-04-27T21:15:47.453",
  "references": [
    {
      "url": "https://github.com/isZzzz/BASRT-B_BACnet_Router_Document/blob/main/BASER-B_backdoor.pcapng",
      "source": "cna@vuldb.com"
    },
    {
      "url": "https://github.com/isZzzz/BASRT-B_BACnet_Router_Document/blob/main/BASRT_CVE_apply.pdf",
      "source": "cna@vuldb.com"
    },
    {
      "url": "https://vuldb.com/?ctiid.262224",
      "source": "cna@vuldb.com"
    },
    {
      "url": "https://vuldb.com/?id.262224",
      "source": "cna@vuldb.com"
    },
    {
      "url": "https://vuldb.com/?submit.320749",
      "source": "cna@vuldb.com"
    },
    {
      "url": "https://github.com/isZzzz/BASRT-B_BACnet_Router_Document/blob/main/BASER-B_backdoor.pcapng",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/isZzzz/BASRT-B_BACnet_Router_Document/blob/main/BASRT_CVE_apply.pdf",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://vuldb.com/?ctiid.262224",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://vuldb.com/?id.262224",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://vuldb.com/?submit.320749",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cna@vuldb.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-404"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability classified as critical has been found in Contemporary Controls BASrouter BACnet BASRT-B 2.7.2. Affected is an unknown function of the component Device-Communication-Control Service. The manipulation with the input 55ff0500370015f30104025506110afb7519035d0841e4bece257b6acfc71f leads to denial of service. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-262224. NOTE: The vendor was contacted early about this disclosure but did not respond in any way."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad ha sido encontrada en Contemporary Controls BASrouter BACnet BASRT-B 2.7.2 y clasificada como crítica. Una función desconocida del componente Device-Communication-Control Service es afectada por esta vulnerabilidad. La manipulación con el input 55ff0500370015f30104025506110afb7519035d0841e4bece257b6acfc71f provoca una denegación de servicio. El exploit ha sido divulgado al público y puede utilizarse. El identificador de esta vulnerabilidad es VDB-262224. NOTA: Se contactó primeramente con el proveedor sobre esta divulgación, pero no respondió de ninguna manera."
    }
  ],
  "lastModified": "2026-06-17T08:01:36.773",
  "sourceIdentifier": "cna@vuldb.com"
}