CVE-2022-42982

Vulnerability

BKG Professional NtripCaster version 2.0.39 and earlier [2] responds to unauthenticated UDP requests for the NTRIP sourcetable. The sourcetable is typically tens of kilobytes in size, while a request can be as small as 30 bytes. Normally, only authenticated streaming data is provided over UDP, but the sourcetable endpoint lacks authentication, allowing anyone to request it.

Exploitation

An attacker can send a crafted UDP packet (e.g., the payload 0x80, 0x61, 0x04, 0xd2, ... as described in [2]) to the server. The server responds with the full sourcetable. No authentication or prior knowledge is required. The attacker can spoof the source IP address to direct the large response to a victim, enabling a UDP amplification attack.

Impact

The primary impact is the ability to conduct amplified DDoS attacks. The amplification factor is significant (small request, large response). While the sourcetable itself may leak information about available streams, the main consequence is network availability degradation for the victim.

Mitigation

As of the available references, no patched version has been announced. The recommended mitigation is to configure the server to reject SOURCETABLE requests over UDP and only provide authenticated streaming data via UDP [2]. Users should consult the vendor's changelog [1] for future security updates.