Unauthorized Access in BACnet Stack Protocol Library for Embedded Systems
CVE-2026-102612

8.1HIGH

Key Information:

Vendor

Bacnet-stack

Status
Bacnet-stack
Vendor
CVE Published:
13 November 2026

What is CVE-2026-102612?

The BACnet Stack protocol library for embedded systems has a significant vulnerability due to an improper configuration in its websocket server options. Prior to specified versions, the library allowed any network-reachable host to connect to the BACnet/SC mesh without requiring valid TLS client certificates. This lack of stringent client certificate verification resulted in potential unauthorized access, which could lead to severe security risks within networked environments. The issue has been addressed in later releases, emphasizing the importance of updating to the latest versions.

Affected Version(s)

bacnet-stack < 1.4.6 < 1.4.6

bacnet-stack >= 1.5.0, < 1.5.2 < 1.5.0, 1.5.2

bacnet-stack >= 1.6.0, < 1.6.1 < 1.6.0, 1.6.1

References

https://github.com/bacnet-stack/bacnet-stack/security/adv...
x_refsource_CONFIRM
https://github.com/bacnet-stack/bacnet-stack/pull/1436
x_refsource_MISC

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.