CVE-2024-52296

Summary

CVE-2024-52296 is a vulnerability affecting the libosdp implementation of Open Supervised Device Protocol (OSDP). In the ospd_reply_name function of ospd_common.c, any reply ID within the range of REPLY_ACK to REPLY_XRD is considered valid, despite the names array not declaring all elements in that range. If an undefined reply ID is encountered, the name variable will be set to null, leading to a crash when checking if the name's first character is null. This issue does not require a secure connection, making it potentially exploitable by attackers without prior knowledge. Version 2.4.0 includes a fix for this issue.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.