CVE-2022-42982

Description

BKG Professional NtripCaster 2.0.39 allows querying information over the UDP protocol without authentication. The NTRIP sourcetable is typically quite long (tens of kBs) and can be requested with a packet of only 30 bytes. This presents a vector that can be used for UDP amplification attacks. Normally, only authenticated streaming data will be provided over UDP and not the sourcetable.

Related CPE's

abundbkg_professional_ntripcaster********

References

https://igs.bkg.bund.de/ntrip/bkgcaster

ProductVendor Advisory

https://cve.mahi.be/bkg_ntrip_udp/

Third Party Advisory

CvssV3 impact

Could not find any metrics

CvssV2 impact

Could not find any metrics
Created by Yello
About Severity.io