Remote Denial of Service Vulnerability in BACnet Test Server by BACnet
CVE-2020-36872

8.7HIGH

Key Information:

Vendor: Bacnet Interoperability Test Services, Inc.
Status: Bacnet Test Server
Vendor: CVE Published:; 26 November 2025

🔔 Create Bacnet Interoperability Test Services, Inc. Vulnerability Alert

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2020-36872?

The BACnet Test Server, specifically versions up to and including 1.01, is susceptible to a remote denial of service attack due to inadequate validation of the BVLC Length field in incoming UDP packets. An attacker can exploit this vulnerability by sending a specially crafted BVLC Length value, which triggers an application crash and effectively denies service to legitimate users. This vulnerability highlights critical inadequacies in the packet handling processes of the BACnet Test Server.

Affected Version(s)

BACnet Test Server 0 <= 1.01

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2020-36872 - Proof of Concept