CVE-2026-45341 in BACnet Stack
Summary
by MITRE • 11/12/2026
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. From versions 1.4.0 to before 1.4.4, and 1.5.0 to before 1.5.1, a NULL pointer dereference can be triggered in bacnet_device_object_reference_decode() when a WriteProperty request updates OBJECT_STRUCTURED_VIEW / PROP_SUBORDINATE_LIST. This issue has been patched in versions 1.4.4 and 1.5.1.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 11/12/2026
The BACnet Stack is an open-source C library designed to implement the Building Automation and Control Networks protocol, facilitating communication between devices in smart building environments such as HVAC systems, lighting controls, and access control mechanisms. This software stack serves as a critical component for embedded systems that require standardized interoperability within industrial automation networks. The vulnerability identified affects specific releases of this library, namely versions ranging from 1.4.0 up to but not including 1.4.4, and version 1.5.0 up to but not including 1.5.1. These versions contain a logic flaw in the parsing routine responsible for handling device object references during property updates.
The technical root cause of this vulnerability lies within the function bacnet_device_object_reference_decode(), which is invoked when processing WriteProperty requests targeting specific properties such as OBJECT_STRUCTURED_VIEW or PROP_SUBORDINATE_LIST. Under normal operation, this function parses incoming data to identify subordinate devices or structured views associated with a BACnet object. However, due to insufficient validation of input parameters and missing null checks before dereferencing pointers derived from the parsed data, an attacker can craft a maliciously formatted WriteProperty request that causes the pointer value to be NULL. When the code attempts to access memory at this NULL address, it triggers a segmentation fault or similar exception resulting in a NULL pointer dereference. This constitutes a classic instance of improper input validation leading to application instability.
From an operational perspective, this vulnerability primarily results in a denial-of-service condition against BACnet-enabled devices running the affected stack versions. Since embedded systems often run with limited resources and lack robust error recovery mechanisms for critical protocol handlers, a crash in the network processing thread can cause the entire device to become unresponsive or require a hard reset. In industrial control environments where continuous monitoring is essential, such disruptions can lead to significant downtime, loss of visibility into building operations, and potential safety risks if fail-safe states are not properly maintained during outages. The attack vector typically involves sending crafted network packets over the BACnet IP transport layer, allowing remote exploitation by any entity with network access to the target device segment.
This flaw aligns with CWE-476, which describes a NULL Pointer Dereference vulnerability where software fails to check for null pointers before using them as valid memory addresses. Additionally, from an offensive security framework perspective, this behavior is consistent with techniques found in MITRE ATT&CK under the Disruption category, specifically resource hijacking or denial of service via application crashes. The lack of robust exception handling allows a single malformed packet to disrupt service availability without requiring authentication if the WriteProperty endpoint is accessible to untrusted networks.
Mitigation strategies focus on immediate software updates and network segmentation. Organizations utilizing BACnet infrastructure should upgrade their embedded devices to version 1.4.4 or later, including all subsequent releases in the 1.5.x branch such as 1.5.1 and beyond, where this issue has been patched by adding appropriate null checks within the decode function. For systems that cannot be immediately updated, network-level controls should be implemented to restrict access to BACnet ports from untrusted zones. Deploying firewalls or intrusion prevention systems capable of inspecting protocol payloads can help filter out malformed packets before they reach vulnerable endpoints. Furthermore, implementing strict input validation at the application gateway level and monitoring for abnormal traffic patterns indicative of fuzzing attacks can provide an additional layer of defense against exploitation attempts.