CVE-2024-4791
📛 CVE Title
Contemporary Control System BASrouter BACnet BASRT-B Application Protocol Data Unit denial of service
Description
A vulnerability classified as critical was found in Contemporary Control System BASrouter BACnet BASRT-B 2.7.2. This vulnerability affects unknown code of the component Application Protocol Data Unit. The manipulation leads to denial of service. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-263890 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Overview
- State
- PUBLISHED
- Assigner (CNA)
- VulDB
- CVSS severity
- HIGH
- CVSS score
- 8.7 / 10
- CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N- Effective score
- 8.7 / 10 HIGH source: CNA overview
- CWE(s)
-
CWE-404 - Reserved
- 2024-05-11
- Published
- 2024-05-12 03:00 UTC
- Last updated
- 2024-08-08 21:20 UTC
- Source
- https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/4xxx/CVE-2024-4791.json
- Linked Threat
- CVE-2024-4791 — Contemporary Control System BASrouter BACnet BASRT-B Application Protocol Data Unit denial of service
European Union Vulnerability Database ENISA EUVD
ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.
- EUVD ID
-
EUVD-2024-44384 - Assigner
- VulDB
- Published
- May 12, 2024, 1:00:05 AM
- Updated
- Aug 8, 2024, 7:20:09 PM
- EUVD base score (CVSS 4.0)
-
8.7 / 10
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - EUVD-reported EPSS
- 0.2000
- Vendors
- Contemporary Control System
- Products
-
BASrouter BACnet BASRT-B (2.7.2)
- Aliases
-
GHSA-vrw8-cjgh-777g
ENISA description: A vulnerability classified as critical was found in Contemporary Control System BASrouter BACnet BASRT-B 2.7.2. This vulnerability affects unknown code of the component Application Protocol Data Unit. The manipulation leads to denial of service. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-263890 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Affected products (1)
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| Contemporary Control System | BASrouter BACnet BASRT-B |
2.7.2 (affected)
|
— |
Vendor references (5)
References embedded in the original CVE record by the assigning CNA.
- VDB-263890 | Contemporary Control System BASrouter BACnet BASRT-B Application Protocol Data Unit denial of service vdb-entry
- VDB-263890 | CTI Indicators (IOB, IOC, TTP) signaturepermissions-required
- Submit #323630 | Contemporary Control System BASRT-B 2.7.2 Denial of Service third-party-advisory
- https://github.com/isZzzz/BASRT-B_BACnet_Router_Document/blob/main/BASRT-B_2_CVE_apply.pdf broken-link
- https://github.com/isZzzz/BASRT-B_BACnet_Router_Document/blob/main/BASER-B_APDU.pcapng broken-linkexploit
Web references (0)
DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.
No web references attached yet.
Remediations (17)
Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.
-
web:catalog.update.microsoft.com
Welcome to the Microsoft Update Catalog site. We want your feedback! Visit our newsgroup or send us an email to provide us with your thoughts and suggestions. To get started using the site, enter in your search terms in the Search box above or visit our FAQ for search tips. |Newsgroup|Send us your feedback
2026-08-05 12:57 UTC -
web:experienceleague.adobe.com
The Adobe Commerce security patch release notes provide information about the latest security improvements for supported versions of Adobe Commerce. About security patch releases Security Bug Fix : A software code change that resolves an identified security issue and delivers expected results in an affected product area.
2026-08-05 12:57 UTC -
web:learn.microsoft.com
Learning path Learn how Microsoft supports secure software development as part of a cybersecurity solution - Training Secure software development means integrating security into each phase of your development lifecycle, from requirements analysis to maintenance. Microsoft provides many services that can help you develop more secure code and deploy a more secure application in the cloud. This ...
2026-08-05 12:57 UTC -
web:msrc.microsoft.com
Access Microsoft Security Response Center's guide to address vulnerabilities, manage security risks, and keep your systems protected with the latest updates.
2026-08-05 12:57 UTC -
web:support.servicenow.com
ServiceNow Posture July, 2024 Description ServiceNow has addressed an input validation vulnerability that was identified in Vancouver and Washington, D.C. Now Platform releases. This vulnerability could
2026-08-05 12:57 UTC -
web:windowsforum.com
Mitigation Is a Bridge, Not a Strategy When a kernel-mode protocol stack receives a security fix , the durable answer is to apply the update. Mitigations can reduce exposure, but they rarely provide the same assurance as patched code. For CVE -2026-47291, that distinction matters because public detail is limited: defenders cannot safely craft a precise request filter for a trigger they do not ...
2026-08-05 12:57 UTC -
web:www.microsoft.com
These Knowledge Base articles accompany all security updates and advisories, and include caveats or known issues with security updates. Additionally, support engineers document common concerns from customers in these KB articles. These Knowledge Base articles are published the Security Update Guide with each release on Patch Tuesday.
2026-08-05 12:57 UTC -
web:www.securityweek.com
Microsoft has announced mitigations for CVE -2026-45585, a BitLocker bypass triggered via FsTx in Windows Recovery.
2026-05-22 10:38 UTC -
web:www.tomshardware.com
Microsoft released security update KB5034441 on Patch Tuesday to fix a BitLocker encryption bypass vulnerability affecting Windows 10 users. However, some users are experiencing an update failure ...
2026-05-22 10:38 UTC -
web:www.computerworld.com
Each month, the team at Readiness analyzes the latest Patch Tuesday updates from Microsoft and provides detailed, actionable testing guidance. The company's Patch Tuesday release for February ...
2026-05-22 10:38 UTC -
web:www.maketecheasier.com
Check out the latest Windows 11 and Windows 10 update problems and their solutions, as recommended by Microsoft experts.
2026-05-22 10:38 UTC -
web:www.windowslatest.com
Windows 11 April 2026 update adds Narrator Copilot support, faster Settings, File Explorer fixes, and key security improvements.
2026-05-22 10:38 UTC -
web:www.neowin.net
Microsoft has released Patch Tuesday updates for Windows 11 KB5077181, KB5075941 for February 2026. Here's what's included.
2026-05-22 10:38 UTC -
web:www.notebookcheck.net
Microsoft's Windows 11 KB5083769 April 2026 update causes critical boot failures, pixelated BSODs, and BitLocker recovery loops on Windows 11 24H2 and 25H2 PCs.
2026-05-22 10:38 UTC -
web:nvd.nist.gov
Description ServiceNow has addressed an input validation vulnerability that was identified in Vancouver and Washington DC Now Platform releases. This vulnerability could enable an unauthenticated user to remotely execute code within the context of the Now Platform. ServiceNow applied an update to hosted instances, and ServiceNow released the update to our partners and self-hosted customers ...
2026-05-22 10:38 UTC -
web:portal.msrc.microsoft.com
The Security Update Guide provides information on the latest Microsoft security updates, helping users understand and address potential vulnerabilities effectively.
2026-05-22 10:38 UTC -
web:support.servicenow.com
ServiceNow Posture July, 2024 Description ServiceNow has addressed an input validation vulnerability that was identified in Vancouver and Washington, D.C. Now Platform releases. This vulnerability could
2026-05-22 10:38 UTC
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.
Raw JSON
The full cvelistV5 record. Download as CVE-2024-4791.json.
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-01T20:55:09.322Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "VDB-263890 | Contemporary Control System BASrouter BACnet BASRT-B Application Protocol Data Unit denial of service",
"tags": [
"vdb-entry",
"x_transferred"
],
"url": "https://vuldb.com/?id.263890"
},
{
"name": "VDB-263890 | CTI Indicators (IOB, IOC, TTP)",
"tags": [
"signature",
"permissions-required",
"x_transferred"
],
"url": "https://vuldb.com/?ctiid.263890"
},
{
"name": "Submit #323630 | Contemporary Control System BASRT-B 2.7.2 Denial of Service",
"tags": [
"third-party-advisory",
"x_transferred"
],
"url": "https://vuldb.com/?submit.323630"
},
{
"tags": [
"broken-link",
"x_transferred"
],
"url": "https://github.com/isZzzz/BASRT-B_BACnet_Router_Document/blob/main/BASRT-B_2_CVE_apply.pdf"
},
{
"tags": [
"broken-link",
"exploit",
"x_transferred"
],
"url": "https://github.com/isZzzz/BASRT-B_BACnet_Router_Document/blob/main/BASER-B_APDU.pcapng"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-4791",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-08T19:19:56.183695Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-08T19:20:09.415Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"modules": [
"Application Protocol Data Unit"
],
"product": "BASrouter BACnet BASRT-B",
"vendor": "Contemporary Control System",
"versions": [
{
"status": "affected",
"version": "2.7.2"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "isZzzzz (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability classified as critical was found in Contemporary Control System BASrouter BACnet BASRT-B 2.7.2. This vulnerability affects unknown code of the component Application Protocol Data Unit. The manipulation leads to denial of service. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-263890 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way."
},
{
"lang": "de",
"value": "In Contemporary Control System BASrouter BACnet BASRT-B 2.7.2 wurde eine Schwachstelle entdeckt. Sie wurde als kritisch eingestuft. Es geht um eine nicht n\u00e4her bekannte Funktion der Komponente Application Protocol Data Unit. Dank der Manipulation mit unbekannten Daten kann eine denial of service-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk erfolgen. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 8.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.8,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-404",
"description": "CWE-404 Denial of Service",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-05-12T01:00:05.262Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-263890 | Contemporary Control System BASrouter BACnet BASRT-B Application Protocol Data Unit denial of service",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/?id.263890"
},
{
"name": "VDB-263890 | CTI Indicators (IOB, IOC, TTP)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.263890"
},
{
"name": "Submit #323630 | Contemporary Control System BASRT-B 2.7.2 Denial of Service",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.323630"
},
{
"tags": [
"broken-link"
],
"url": "https://github.com/isZzzz/BASRT-B_BACnet_Router_Document/blob/main/BASRT-B_2_CVE_apply.pdf"
},
{
"tags": [
"broken-link",
"exploit"
],
"url": "https://github.com/isZzzz/BASRT-B_BACnet_Router_Document/blob/main/BASER-B_APDU.pcapng"
}
],
"timeline": [
{
"lang": "en",
"time": "2024-05-11T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2024-05-11T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2024-05-11T08:13:37.000Z",
"value": "VulDB entry last update"
}
],
"title": "Contemporary Control System BASrouter BACnet BASRT-B Application Protocol Data Unit denial of service"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2024-4791",
"datePublished": "2024-05-12T01:00:05.262Z",
"dateReserved": "2024-05-11T06:08:16.938Z",
"dateUpdated": "2024-08-08T19:20:09.415Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}