CVE-2025-41753 in 0751-9x01
Summary
by MITRE • 10/01/2026
The object name of a dynamically created BACnet File Object is interpreted as a file path without sufficient validation. Because relative paths are not limited to the intended directory, an unauthenticated remote attacker can traverse outside of it and read or overwrite arbitrary files on the device, which may lead to full system compromise.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/01/2026
The vulnerability described involves a critical flaw in how dynamically created BACnet File Objects handle object names that are interpreted as file paths. This issue stems from insufficient validation mechanisms when processing these inputs, allowing an unauthenticated remote attacker to exploit the lack of path normalization or restriction. Specifically, relative paths provided by the attacker are not constrained within the intended directory structure of the device's filesystem. This oversight enables directory traversal attacks where the attacker can navigate up the directory hierarchy using standard sequences such as dot-dot-slash (../). By manipulating these sequences, the attacker gains the ability to access files located outside the designated scope, effectively bypassing any logical boundaries set by the application or operating system.
The operational impact of this vulnerability is severe and potentially catastrophic for the affected device. Since an unauthenticated remote actor can read arbitrary files, sensitive information such as configuration data, credentials, or proprietary code may be exfiltrated without detection. Furthermore, the ability to overwrite arbitrary files allows the attacker to modify critical system binaries, scripts, or configuration files. This capability directly facilitates full system compromise, enabling persistent access, privilege escalation, and potentially complete control over the device's functionality. In industrial control systems where BACnet is commonly deployed, such a breach could disrupt building automation processes, lead to safety hazards, or serve as an entry point for broader network intrusions targeting connected infrastructure.
From a technical classification perspective, this vulnerability aligns with CWE-22: Improper Limitation of a Pathname to a Restricted Directory (Path Traversal). The root cause lies in the failure to sanitize user-supplied input before using it in file system operations. Additionally, because the attack vector is remote and unauthenticated, it maps closely to MITRE ATT&CK techniques related to Initial Access via Exploitation of Remote Services and subsequent File Discovery or Data Manipulation. The lack of authentication requirement exacerbates the risk significantly, as no prior credentials are needed to initiate the exploit chain.
Mitigation strategies must focus on implementing robust input validation and enforcing strict path constraints. Developers should ensure that all file paths derived from object names are resolved to absolute paths and verified against a predefined allowlist or chroot environment before any read or write operations occur. Utilizing secure coding practices such as canonicalization of paths can prevent relative path manipulation. Furthermore, applying the principle of least privilege ensures that even if an attacker succeeds in traversing directories, their ability to modify critical system files is restricted by file permissions. Regular security audits and static code analysis tools should be employed to detect similar vulnerabilities across other components of the BACnet implementation.