EnOcean SmartServer IoT Out-of-Bounds Read Vulnerability Allowing Memory Leak

A vulnerability exists in EnOcean SmartServer IoT versions through 4.60.009, allowing remote attackers to exploit the LON IP-852 management messages. By sending specially crafted IP-852 messages, attackers can cause a memory leak from the program's memory.

Impact

Exploitation of this vulnerability leads to a memory leak, causing potential performance degradation or resource exhaustion.

Remediation

Users are advised to update EnOcean SmartServer IoT to version 4.6 Update 2 (v4.60.023) or later. For additional mitigations and workarounds, refer to EnOcean's hardening guide.