CVE-2024-41974 Overview
CVE-2024-41974 describes an incorrect permission assignment for critical resources [CWE-732] affecting BACnet service properties. A low-privileged remote attacker can modify BACnet service properties over the network, causing a denial-of-service condition limited to BACnet communication. Building automation and control networks rely on BACnet for HVAC, lighting, and access control coordination, so disruption of these services can affect facility operations.
The vulnerability was disclosed through VDE Security Advisory VDE-2024-047 and published to the National Vulnerability Database (NVD) on November 18, 2024.
Critical Impact
Authenticated remote attackers with low privileges can disable BACnet communication, disrupting building automation services across affected devices.
Affected Products
- Products implementing the affected BACnet service (see VDE-2024-047 for the vendor-confirmed list)
- Building automation controllers exposing BACnet management interfaces
- Operational technology (OT) devices integrating with BACnet/IP networks
Discovery Timeline
- 2024-11-18 - CVE-2024-41974 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-41974
Vulnerability Analysis
The flaw stems from incorrect permission assignment on BACnet service property resources. The affected device allows a user with low-level privileges to invoke write operations that should be restricted to administrative roles. Writable properties include configuration data controlling BACnet communication behavior.
When an authenticated attacker modifies these properties, the BACnet service enters a state where legitimate communication fails. The impact is scoped to BACnet functionality, meaning the underlying device may remain operational while automation traffic is disrupted. In building automation environments, this can prevent monitoring, control, and alarm propagation across connected zones.
Exploitation requires network reachability to the BACnet service and valid low-privileged credentials. The CWE-732 classification indicates the root cause lies in how the device authorizes property write operations rather than in memory safety or protocol parsing.
Root Cause
The device assigns permissions to BACnet service property resources without enforcing the least-privilege model. Property write handlers accept requests from any authenticated session, regardless of role. This allows a standard user account to alter configuration items intended for administrative modification only.
Attack Vector
The attack is delivered over the network using standard BACnet write requests such as WriteProperty or WritePropertyMultiple service primitives. An attacker who has obtained low-privileged credentials, whether through phishing, credential reuse, or default account exposure, can issue these requests directly to the target controller. No user interaction is required. The vulnerability manifests through legitimate protocol messages, so no exploit code is required beyond a standard BACnet client. See VDE-2024-047 for vendor-specific technical details.
Detection Methods for CVE-2024-41974
Indicators of Compromise
- Unexpected WriteProperty or WritePropertyMultiple requests originating from non-administrative BACnet clients
- BACnet devices reporting loss of communication or property changes not associated with a change-management ticket
- Configuration drift on BACnet service properties detected during routine baselining
- Authentication events from low-privileged accounts followed by property modification traffic
Detection Strategies
- Baseline authorized BACnet write operations and alert on writes from accounts outside the administrative group
- Correlate BACnet protocol telemetry with identity events to surface anomalous writes tied to low-privileged sessions
- Monitor for BACnet communication outages that coincide with recent property write activity
Monitoring Recommendations
- Deploy passive OT network monitoring capable of parsing BACnet/IP to inspect service and property identifiers
- Log authentication and authorization decisions on BACnet controllers and forward them to a central SIEM
- Track configuration snapshots of critical BACnet properties and alert on unauthorized deltas
How to Mitigate CVE-2024-41974
Immediate Actions Required
- Apply the vendor-supplied firmware update referenced in VDE-2024-047 once available for the affected model
- Rotate credentials on all BACnet accounts and remove unused low-privileged users
- Restrict network access to BACnet management interfaces to trusted engineering workstations only
Patch Information
Refer to VDE Security Advisory VDE-2024-047 for the authoritative list of fixed firmware versions and vendor guidance. Coordinate patch deployment with facility operations teams to avoid disrupting building automation schedules.
Workarounds
- Segment BACnet networks from corporate IT using firewalls or dedicated OT VLANs
- Enforce access control lists that permit BACnet writes only from authorized engineering hosts
- Disable or restrict low-privileged BACnet accounts where operational workflows permit
- Monitor BACnet property writes and alert on modifications outside approved maintenance windows
# Example firewall rule limiting BACnet/IP (UDP 47808) to an engineering subnet
iptables -A FORWARD -p udp --dport 47808 -s 10.10.20.0/24 -d 10.20.30.0/24 -j ACCEPT
iptables -A FORWARD -p udp --dport 47808 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
