CVE-2024-4511
Shanghai Sunfull Automation BACnet Server HMI1002-ARM Message buffer overflow
- State
- Published
- Severity
- 6.3 Medium
- Published
- May 6, 2024
- Updated
- Aug 1, 2024
- Reserved
- May 5, 2024
Description
A vulnerability classified as critical has been found in Shanghai Sunfull Automation BACnet Server HMI1002-ARM 2.0.4. This affects an unknown part of the component Message Handler. The manipulation leads to buffer overflow. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-263115. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 6.3 Medium | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L | VulDB |
| 3.0 | 6.3 Medium | CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L | VulDB |
| 2.0 | 5.8 Medium | AV:A/AC:L/Au:N/C:P/I:P/A:P | VulDB |
Weaknesses
- CWE-120 Buffer Overflow
Affected Products
| Product | Versions |
|---|---|
BACnet Server HMI1002-ARMShanghai Sunfull Automation |
|
References
- VDB-263115 | Shanghai Sunfull Automation BACnet Server HMI1002-ARM Message buffer overflowvdb-entry
- VDB-263115 | CTI Indicators (IOB, IOC)signaturepermissions-required
- Submit #323832 | Shanghai Sunfull Automation Co., LTD. HMI1002-ARM Firmware Revision: 2.0.4 Buffer Overflowthird-party-advisory
- https://github.com/isZzzz/HMI1002-ARM-Gateway-Document/blob/main/HMI1002-ARM%20apply.pdfrelated
- https://github.com/isZzzz/HMI1002-ARM-Gateway-Document/blob/main/sunfull_bug.pcapngexploit
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.