Logic Flaw in BACnet Stack Open Source Protocol Library from BACnet
CVE-2026-47257

8.1HIGH

Key Information:

Vendor

Bacnet-stack

Status
Bacnet-stack
Vendor
CVE Published:
12 November 2026

What is CVE-2026-47257?

A significant logic flaw has been identified in the BACnet Stack, an open-source protocol stack library for embedded systems. This vulnerability affects versions 1.5.0 and 1.6.0-rc1 and is exploitable through the official management path when the BACNET_BACKUP_RESTORE functionality is enabled. Successfully leveraging this flaw may allow unauthorized access or manipulation of system states, potentially impacting the integrity of the system. The issue has been resolved in the subsequent versions 1.5.1 and 1.6.0, so users are urged to update their installations to these patched versions to ensure system security.

Affected Version(s)

bacnet-stack >= 1.5.0, < 1.5.1 < 1.5.0, 1.5.1

bacnet-stack >= 1.6.0-rc1, < 1.6.0 < 1.6.0-rc1, 1.6.0

References

https://github.com/bacnet-stack/bacnet-stack/security/adv...
x_refsource_CONFIRM
https://github.com/bacnet-stack/bacnet-stack/pull/1352
x_refsource_MISC

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.