CVE-2026-102537
HIGH
MEDIUM
Priority: 0.02
BB Relevance:
60/100
Published: 2026-11-13
Modified: 2026-11-13
First seen: 2026-11-13
Status: active
Attack Surface
Adjacent
Low Complexity
No Auth
No Interaction
Conf. Impact
Integ. Impact
CVSS Vector Breakdown
AV:
Adjacent
AC:
Low
PR:
None
UI:
None
S:
X
AT:
Present
VC:
High
VI:
High
VA:
High
Description
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.6, 1.5.2, and 1.6.1, bws_cli_connect() in ports/linux/websocket-cli.c loads the trusted CA cert into the libwebsockets context, then always sets LCCSCF_ALLOW_SELFSIGNED in the connection flags. So lws accepts any self-signed hub certificate, whether or not it chains to the loaded CA. A BACnet/SC node finishes the TLS handshake to a rogue hub that presents a self-signed cert. It then hands the attacker its identity (VMAC, UUID) and all later BACnet traffic. This issue has been patched in versions 1.4.6, 1.5.2, 1.6.1, and 1.7.0.
Weakness Classification (1)
Affected Software (3)
| Vendor | Product | Version |
|---|---|---|
| bacnet-stack | bacnet-stack | < 1.4.6 |
| bacnet-stack | bacnet-stack | >= 1.5.0, < 1.5.2 |
| bacnet-stack | bacnet-stack | >= 1.6.0, < 1.6.1 |
References & Advisories (2)
x_refsource_MISC
x_refsource_CONFIRM