PatchSiren cyber security CVE debrief

CVE-2024-41717 Kieback & Peter CVE debrief

CVE-2024-41717 is a critical path traversal vulnerability in Kieback&Peter DDC4000 series building automation controllers, published on October 17, 2024. The vulnerability allows unauthenticated remote attackers to read arbitrary files on affected systems, with a CVSS 3.1 score of 9.8 (Critical). The flaw affects ten distinct product variants across two controller generations: legacy DDC4002, DDC4100, DDC4200, DDC4200-L, and DDC4400 controllers (firmware versions ≤1.12.14 or ≤1.7.4), as well as newer DDC4002e, DDC4020e, DDC4040e, DDC4200e, and DDC4400e controllers (firmware ≤1.17.6). The path traversal weakness enables file disclosure without authentication, exposing sensitive system data to network-based attackers. CISA coordinated disclosure of this vulnerability through advisory ICSA-24-291-05. Remediation paths diverge by product generation: the five legacy controller models have reached end-of-life status and receive no further security updates, requiring migration to supported hardware or strict network segmentation; the five extended 'e' series controllers have vendor-supported firmware updates available. Kieback&Peter recommends firmware upgrade to version 1.21.0 or later for all supported DDC systems, with direct contact to local offices required to obtain patches. Organizations operating these building automation controllers in OT environments should prioritize inventory verification, network isolation assessment, and firmware update coordination given the unauthenticated exploitation vector and critical severity rating.

Vendor: Kieback & Peter
Product: DDC4002
CVSS: CRITICAL 9.8
CISA KEV: Not listed in stored evidence
Original CVE published: 2024-10-17
Original CVE updated: 2024-10-17
Advisory published: 2024-10-17
Advisory updated: 2024-10-17

Who should care

Organizations operating Kieback&Peter building automation systems, critical infrastructure facilities using DDC4000 series controllers for HVAC and environmental control, OT security teams managing building management system (BMS) networks, and facility managers responsible for lifecycle management of automation hardware

Technical summary

Path traversal vulnerability in Kieback&Peter DDC4000 series building automation controllers allows unauthenticated remote attackers to read arbitrary files via directory traversal sequences. Affects 10 product variants: DDC4002 (≤1.12.14), DDC4100 (≤1.7.4), DDC4200 (≤1.12.14), DDC4200-L (≤1.12.14), DDC4400 (≤1.12.14), DDC4002e (≤1.17.6), DDC4020e (≤1.17.6), DDC4040e (≤1.17.6), DDC4200e (≤1.17.6), and DDC4400e (≤1.17.6). CVSS 3.1: 9.8 (Critical). Legacy non-'e' models are end-of-life with no patches; 'e' series models have firmware 1.21.0 available through vendor contact.

Defensive priority

critical

Recommended defensive actions

Inventory all Kieback&Peter DDC4000 series controllers in your environment to identify affected models and firmware versions
For DDC4002, DDC4100, DDC4200, DDC4200-L, and DDC4400 (legacy non-'e' models): implement strict network segmentation to isolate these EOL devices from untrusted networks; plan migration to supported DDC4002e, DDC4020e, D
For DDC4002e, DDC4020e, DDC4040e, DDC4200e, and DDC4400e controllers: contact your local Kieback&Peter office to obtain and apply firmware version 1.21.0 or later
Restrict network access to affected controllers at the perimeter and segment within OT networks to limit exposure of unauthenticated path traversal attack surface
Monitor for anomalous file access patterns or unexpected HTTP requests to controller web interfaces that may indicate exploitation attempts
Review and apply CISA ICS recommended practices for defense-in-depth strategies in building automation environments

Evidence notes

Vulnerability description and affected product list derived from CISA CSAF advisory ICSA-24-291-05. CVSS score and vector from official CVE record. Remediation guidance extracted from vendor-provided CSAF remediations section. End-of-life status for legacy controllers explicitly stated in vendor fix remediation category.

Sources and references

Verified primary and authoritative sources

CVE-2024-41717 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2024-41717

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2024-41717 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2024-41717

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Source item URL
Unverified legacy reference

URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2024/icsa-24-291-05.json

cisa_csaf
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/news-events/ics-advisories/icsa-24-291-05

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/topics/industrial-control-systems

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/uscert/sites/default/files/publications/emailscams0905.pdf

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/uscert/ncas/tips/ST04-014

Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.