{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/indiserver--2.2.4.2/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-71979"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["indiserver (\u003c= 2.2.4.2)"],"_cs_severities":["low"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["INDI"],"content_html":"\u003cp\u003eINDI (Instrument Neutral Distributed Interface) indiserver through version 2.2.4.2 is vulnerable to a stack-based buffer overflow in \u003ccode\u003eMsgQueue.cpp\u003c/code\u003e. An unauthenticated remote attacker can trigger this condition by sending a single malformed TCP packet to the default port 7624. The vulnerability arises from an unbounded \u003ccode\u003esprintf()\u003c/code\u003e operation that writes user-supplied XML tag names into a fixed 1024-byte stack buffer. When the tag name exceeds this length, the overflow corrupts the stack, leading to immediate daemon termination. This flaw was addressed in commit 96bbd7f. Given the role of \u003ccode\u003eindiserver\u003c/code\u003e in telescope control and observatory automation, this vulnerability poses a significant risk to the availability of astronomical instrument control systems.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker performs reconnaissance to identify systems running \u003ccode\u003eindiserver\u003c/code\u003e listening on TCP port 7624.\u003c/li\u003e\n\u003cli\u003eAttacker initiates a TCP connection to the target \u003ccode\u003eindiserver\u003c/code\u003e instance.\u003c/li\u003e\n\u003cli\u003eAttacker crafts a custom XML payload containing a tag name field greater than 1024 bytes.\u003c/li\u003e\n\u003cli\u003eAttacker sends the malformed XML payload within a single TCP packet to the established socket.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eindiserver\u003c/code\u003e process receives the packet and passes the data to the parser in \u003ccode\u003eMsgQueue.cpp\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003esprintf()\u003c/code\u003e function executes, performing an unbounded copy of the tag string into the stack buffer.\u003c/li\u003e\n\u003cli\u003eThe stack-based buffer overflow occurs, corrupting the execution stack and triggering a crash.\u003c/li\u003e\n\u003cli\u003eThe daemon service terminates, resulting in a denial-of-service for all connected clients and controlled drivers.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in a complete denial-of-service of the \u003ccode\u003eindiserver\u003c/code\u003e daemon. Because the service manages the communication interface between control software and hardware drivers, a crash terminates all active sessions, disrupts data acquisition, and halts ongoing astronomical observations. The attack requires no authentication and can be performed remotely against any exposed instance.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate \u003ccode\u003eindiserver\u003c/code\u003e to a version containing the fix implemented in commit 96bbd7f.\u003c/li\u003e\n\u003cli\u003eRestrict network access to port 7624 using host-based firewalls or network ACLs to ensure only authorized control machines can reach the service.\u003c/li\u003e\n\u003cli\u003eDeploy network intrusion detection signatures to identify TCP packets directed at port 7624 containing unusually large XML tag identifiers.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-17T18:50:15Z","date_published":"2026-08-17T18:50:15Z","id":"https://feed.craftedsignal.io/briefs/2026-08-indi-overflow/","summary":"An unauthenticated remote attacker can crash the INDI indiserver daemon via a stack-based buffer overflow triggered by malformed XML input containing excessively long tags.","title":"Stack Buffer Overflow in INDI indiserver","url":"https://feed.craftedsignal.io/briefs/2026-08-indi-overflow/"}],"language":"en","title":"CraftedSignal Threat Feed - Indiserver (\u003c= 2.2.4.2)","version":"https://jsonfeed.org/version/1.1"}