CVE-2025-66624: BACnet Stack DoS Vulnerability

CVE-2025-66624 Overview

CVE-2025-66624 is an out-of-bounds read vulnerability in the BACnet Protocol Stack library, which provides BACnet application layer, network layer and media access (MAC) layer communications services. The vulnerability exists in the npdu_is_expected_reply function within src/bacnet/npdu.c, where array indexing operations on request_pdu and reply_pdu buffers occur without proper bounds verification. This allows attackers to trigger memory access violations through specially crafted network packets, resulting in denial of service conditions.

Critical Impact
Attackers can remotely crash BACnet-enabled devices or cause undefined behavior by sending malformed PDU packets, disrupting building automation and industrial control systems.

Affected Products

bacnetstack bacnet_stack versions prior to 1.5.0.rc2
BACnet Protocol Stack version 1.5.0:rc1

Discovery Timeline

2025-12-05 - CVE CVE-2025-66624 published to NVD
2026-02-18 - Last updated in NVD database

Technical Details for CVE-2025-66624

Vulnerability Analysis

The vulnerability is classified as CWE-125 (Out-of-Bounds Read), occurring when the npdu_is_expected_reply() function processes network protocol data units (NPDUs). The function accesses specific offsets within the request and reply PDU buffers (request_pdu[offset+2/3/5] and reply_pdu[offset+1/2/4]) without first validating that those byte positions actually exist within the buffer boundaries.

The bacnet_npdu_decode() function can return an offset value of 2 for a minimal 2-byte NPDU. When this occurs, tiny PDUs pass the initial version check but subsequent array accesses read beyond the allocated buffer boundaries. On systems with Address Sanitizer (ASan), Memory Protection Units (MPU), or strict memory protection builds, this results in an immediate crash. On unprotected builds, the behavior is undefined and may cause reply mis-routing between BACnet devices.

Root Cause

The root cause is insufficient input validation in the npdu_is_expected_reply() function. The code assumes that PDU buffers contain sufficient bytes to access the required offsets for extracting PDU type, invoke ID, and service choice fields. No length checks are performed before the array indexing operations, allowing undersized packets to trigger out-of-bounds memory reads.

Attack Vector

This vulnerability can be exploited remotely over the network without authentication. An attacker can craft malicious BACnet packets with undersized PDUs that pass the protocol version check but contain fewer bytes than expected by the reply matching logic. When processed by a vulnerable BACnet stack implementation, these packets cause out-of-bounds memory access. The attack is particularly concerning for building automation systems, HVAC controllers, and industrial control environments that rely on BACnet communications.

     if (request.npdu_data.network_layer_message) {
         return false;
     }
+    if (request_pdu_len <= offset) {
+        return false;
+    }
+    /* confirmed service request? */
     request.pdu_type = request_pdu[offset] & 0xF0;
     if (request.pdu_type != PDU_TYPE_CONFIRMED_SERVICE_REQUEST) {
         return false;
     }
+    if (request_pdu_len <= (offset + 2)) {
+        return false;
+    }
     request.invoke_id = request_pdu[offset + 2];
     /* segmented request? */
     if (request_pdu[offset] & BIT(3)) {
+        if (request_pdu_len <= (offset + 5)) {
+            return false;
+        }
         request.service_choice = request_pdu[offset + 5];
     } else {
+        if (request_pdu_len <= (offset + 3)) {
+            return false;
+        }
         request.service_choice = request_pdu[offset + 3];
     }
     if ((reply_pdu_len > 0) && (reply_pdu[0] != BACNET_PROTOCOL_VERSION)) {

Source: GitHub Commit Update

Detection Methods for CVE-2025-66624

Indicators of Compromise

Unexpected crashes or service restarts of BACnet-enabled devices or applications
Memory access violation errors in system logs related to BACnet stack components
Abnormally small BACnet PDU packets (less than 3 bytes) observed on network traffic
Repeated connection attempts with malformed BACnet NPDU headers from external sources

Detection Strategies

Deploy network intrusion detection rules to identify malformed BACnet packets with insufficient NPDU length
Monitor BACnet/IP traffic (UDP port 47808) for packets with PDU lengths smaller than expected minimums
Implement application-level logging in BACnet stack implementations to capture parsing errors
Use memory sanitizers (ASan) in development and testing environments to catch out-of-bounds access attempts

Monitoring Recommendations

Enable detailed logging for BACnet communication services to track parsing failures
Monitor system stability metrics for devices running BACnet Protocol Stack implementations
Set up alerts for abnormal crash patterns or service disruptions on building automation controllers
Review network traffic patterns for unusual BACnet packet sizes or frequencies

How to Mitigate CVE-2025-66624

Immediate Actions Required

Upgrade BACnet Protocol Stack to version 1.5.0.rc2 or later immediately
Audit all deployed BACnet-enabled devices and applications for vulnerable library versions
Implement network segmentation to isolate BACnet networks from untrusted networks
Enable intrusion detection monitoring on BACnet network segments

Patch Information

The vulnerability has been addressed in commit 9378f7d1e70169ebde4a5090bae7603703eadf48. The fix adds proper bounds checking before each array access in the npdu_is_expected_reply() function, verifying that the PDU buffer contains sufficient bytes before indexing. Users should update to BACnet Protocol Stack version 1.5.0.rc2 or later. For detailed patch information, refer to the GitHub Security Advisory GHSA-8wgw-5h6x-qgqg.

Workarounds

Restrict network access to BACnet services using firewalls, allowing only trusted IP addresses
Implement VPN or encrypted tunnels for remote BACnet communications to limit exposure
Deploy network-level packet filtering to drop malformed BACnet packets before reaching vulnerable devices
Consider placing vulnerable devices behind application-layer proxies that validate BACnet protocol conformance

bash

# Network isolation example using iptables
# Restrict BACnet/IP traffic (UDP 47808) to trusted network only
iptables -A INPUT -p udp --dport 47808 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p udp --dport 47808 -j DROP