CVE-2024-5948 is a stack-based buffer overflow in how Deep Sea Electronics DSE855 devices handle multipart boundaries, scored 8.8 (High). A network-adjacent attacker needs no login to run code on the device. The vendor never patched it, per ZDI, so isolate it.
What's affected
The record lists DSE855 firmware 1.1.0 and describes missing length validation before user data is copied into a fixed size stack buffer. The weaknesses are CWE-121 (stack-based buffer overflow) and CWE-787 (out-of-bounds write). The vector is CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, so the attacker must be on the same network segment.
ZDI-24-672 says the vendor responded to outreach with process questions but not with a fix, and that ZDI assumed the flaw remained unpatched when it published on 13 June 2024. It names no fixed version, and its only mitigation is to restrict interaction with the application.
The DSE855 is an Ethernet communications module used with generator controllers. NVD is the only score I have. There is no vendor conflict, and no sign of exploitation in the record.
How to check if you're exposed
Identify DSE855 modules in your asset list or by scanning your management VLANs for devices whose web interface identifies as Deep Sea Electronics. Read the firmware version from the device status page and note whether it is 1.1.0.
Then check which networks can reach the web interface. The attack needs adjacency, so list who shares a segment with each device.
What to do now
- Inventory every DSE855 and record firmware versions.
- Put the devices on an isolated management network with no general user or guest access.
- Restrict access to the web interface by firewall rule to named administrator hosts.
- Ask Deep Sea Electronics whether a firmware update exists and record the reply.
- Monitor the segment for unexpected hosts, since adjacency is the entry condition.
Why it matters
A stack overflow occurs when a program copies more data into a fixed buffer than fits. Neighbouring memory, including control data, is overwritten. Embedded devices often lack the protections that desktop systems add, so these flaws lead to code execution more easily.
There is no patch, so the only controls are network ones. Generator monitoring equipment is part of building resilience, and an unpatched module on a flat network is an avoidable weak point.
Quick check
Is there a firmware fix?
ZDI says none was known when it published. Ask the vendor.
Can the internet reach it?
Not by itself per the vector, which is adjacent. But if the device is exposed through port forwarding, that changes the picture.
Sources
- ZDI-24-672
- NVD record for CVE-2024-5948
- Gold entry
Last reviewed: 19 October 2026.
