CVE-2024-4791: BASrouter BACnet BASRT-B DoS Vulnerability

CVE-2024-4791 Overview

CVE-2024-4791 is a remotely exploitable denial of service vulnerability in the Contemporary Controls BASrouter BACnet BASRT-B version 2.7.2. The flaw resides in the handling of the Application Protocol Data Unit (APDU) component of the BACnet protocol stack. An unauthenticated attacker can send crafted APDU packets across the network to disrupt router availability, classified under [CWE-404] Improper Resource Shutdown or Release. The exploit details have been publicly disclosed through VulDB entry VDB-263890, increasing the risk of opportunistic attacks against exposed building automation devices. The vendor was contacted but did not respond to the disclosure, and no patch is currently referenced.

Critical Impact
Unauthenticated remote attackers can trigger a denial of service against BACnet BASRT-B routers, disrupting building automation network traffic.

Affected Products

Contemporary Controls BASrouter BACnet BASRT-B version 2.7.2
Application Protocol Data Unit (APDU) processing component
Building automation networks routing BACnet traffic through affected hardware

Discovery Timeline

2024-05-14 - CVE-2024-4791 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2024-4791

Vulnerability Analysis

The BASrouter BASRT-B is a BACnet/IP to MS/TP gateway used in building automation systems to route HVAC, lighting, and access control traffic. The vulnerability resides in how the device parses and processes Application Protocol Data Units, the core message format used by BACnet at the network layer. Improper resource handling during APDU processing causes the router to terminate or hang when specific malformed packets are received. Public references include a packet capture sample and an application document published in the BASRT-B BACnet Router Document repository and the CVE Application Guide.

Root Cause

The root cause is improper resource shutdown or release ([CWE-404]) within the BACnet APDU parser. When the device receives a specifically structured APDU, internal resources are not released or recovered correctly, causing the router service to become unavailable. The flaw indicates missing validation or error-handling paths around APDU framing or segmentation logic.

Attack Vector

The attack vector is the network. BACnet/IP traffic typically operates over UDP port 47808 (0xBAC0). An attacker with reachability to the router, including adjacent attackers on a flat operational technology network or remote attackers on exposed devices, can transmit the crafted APDU to trigger the denial of service. The attack requires no authentication and no user interaction. Additional technical details are provided in the VulDB #263890 Details and VulDB #263890 CTI Report. The current EPSS score is 1.27%, placing the CVE in the 65th percentile for exploitation probability.

Detection Methods for CVE-2024-4791

Indicators of Compromise

Unexpected loss of BACnet/IP connectivity to the BASRT-B router, including failed routing between BACnet/IP and MS/TP segments
Inbound UDP traffic to port 47808 from unexpected sources containing malformed or oversized APDU payloads
BACnet device-down alarms or repeated reboots reported by the building management system

Detection Strategies

Deploy a BACnet-aware deep packet inspection signature for malformed APDU structures on operational technology network segments
Baseline normal BACnet/IP traffic volume and alert on sudden surges of APDU traffic toward the router
Correlate building management system loss-of-communication events with network telemetry to identify attack windows

Monitoring Recommendations

Monitor router uptime and ICMP reachability for the BASRT-B device with continuous polling
Capture and review BACnet/IP traffic on UDP 47808 for non-conforming protocol structures
Forward operational technology network logs and building automation alarms to a centralized SIEM for correlation

How to Mitigate CVE-2024-4791

Immediate Actions Required

Restrict network reachability to the BASRT-B router so only authorized BACnet controllers and workstations can send traffic to UDP port 47808
Place affected BACnet routers behind a firewall or VLAN segmented away from corporate and internet-facing networks
Disable any port forwarding or external NAT mappings that expose BACnet devices to untrusted networks
Maintain monitoring for router availability and have a documented power-cycle or failover procedure for recovery

Patch Information

No vendor patch is referenced in available sources. The vendor was contacted prior to public disclosure but did not respond. Operators should track communications from Contemporary Controls for future firmware updates addressing the APDU handling defect, and review the VulDB CTI Report for status changes.

Workarounds

Apply strict access control lists at upstream switches or firewalls to permit BACnet/IP traffic only from known controllers
Use a BACnet-aware industrial firewall or protocol gateway to filter malformed APDU packets before they reach the router
Isolate building automation networks from IT networks and require VPN access for any remote engineering work
Conduct periodic configuration backups so devices can be rapidly restored after a denial of service event

bash

# Configuration example: restrict BACnet/IP (UDP 47808) to authorized hosts only
# Replace addresses with your BACnet controller and BASRT-B router IPs
iptables -A FORWARD -p udp --dport 47808 -s 10.10.20.0/24 -d 10.10.30.5 -j ACCEPT
iptables -A FORWARD -p udp --dport 47808 -d 10.10.30.5 -j DROP