CVE-2026-35084: Stack buffer overflow in method dali-devconfig

Synopsis

A stack buffer overflow exists in the dali-devconfig method across multiple MBS device variants (Single-A, Double-A Profibus, Double-A x-link, Single-X, Double-X CAN, Double-X DALI, Double-X KNX, and Double-X LON) running firmware versions from V1_0_0_0 up to but not including V6_0_0_7. The vulnerability is reachable over the network by any authenticated user with standard (low-privilege) credentials, requiring no additional interaction. Successful exploitation gives the attacker full root-level control of the affected system. A patched-image rebuild at V6_0_0_7 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the dali-devconfig service over the network; the CVSS vector specifies AV:N, meaning no local or physical access is required.

• AuthenticationRequired

  A valid low-privilege user account is sufficient to trigger the overflow; the CVSS vector specifies PR:L, so anonymous access alone is not enough.

• Victim interactionNot required

  No user action or social engineering is needed; the CVSS vector specifies UI:N, so the attacker can exploit the service directly.

• Attack complexityDetail

  Exploitation is reliable and condition-free; the CVSS vector specifies AC:L and AT:N, meaning no race conditions or special environmental circumstances are required.

Blast Radius

• The attacker gains full root-level code execution on the affected MBS device, obtaining complete control over the operating system and all running processes.
• All locally stored credentials, configuration data, and communication keys held on the device are readable by the attacker.
• The attacker can modify firmware configuration, persisted device state, and any data written to storage on the device.
• The device itself can be crashed or rendered inoperable, disrupting any building-automation or industrial protocol (DALI, KNX, LON, CAN, Profibus) traffic it is brokering.