A remote buffer overflow vulnerability in Open Vehicle Monitoring System 3 allows unauthenticated attackers to cause denial of service or execute arbitrary code.

This is a buffer overflow vulnerability located in the canformat_canswitch.cpp file, where the parser fails to properly validate a CANswitch DLC value. The attack vector is network-based and requires no privileges or user interaction.

A successful exploit can lead to system crashes, operational disruption, or potential remote code execution on the vehicle monitoring hardware. Given the high CVSS score of 8.6, organizations face significant risks to system availability and integrity, which could result in severe operational downtime and safety concerns for connected vehicular assets.

Immediate Action: Apply the vendor security updates as soon as they become available via the official GitHub repository or vendor advisory channels.

Proactive Monitoring: Monitor network traffic for anomalous CANframe payloads and review system logs for unexpected reboots or service crashes.

Compensating Controls: Implement network segmentation to isolate the monitoring system from untrusted networks and restrict ingress traffic to trusted sources only.

Public Exploit Available: Yes, a published PoC exists via the referenced GitHub advisory and Gist.

This high severity vulnerability presents a serious risk to system availability and control through potential remote code execution. Security teams must monitor the official Open Vehicle repository closely for patch releases and apply remediation updates immediately upon availability.