CVE-2026-47711 in BACnet Stack
Summary
by MITRE • 11/12/2026
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.4, 1.5.1, and 1.6.0, the current master demo server can be crashed remotely over BACnet/IP by sending a valid Confirmed WriteProperty request that updates loop-1's controlled-variable-reference to point to life-safety-zone-1 / accepted-modes. This issue has been patched in versions 1.4.4, 1.5.1, and 1.6.0.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 11/12/2026
The BACnet Stack is an open-source C library designed for implementing the Building Automation and Control Networks protocol on embedded systems. A critical remote code execution vulnerability exists within this stack prior to versions 1.4.4, 1.5.1, and 1.6.0. The flaw resides in the handling of Confirmed WriteProperty requests specifically targeting loop-1's controlled-variable-reference attribute. An attacker can exploit this weakness by sending a maliciously crafted BACnet/IP packet that updates the reference to point towards life-safety-zone-1 accepted-modes. This specific manipulation causes the server process to crash, resulting in a denial of service condition for building automation systems relying on this stack.
From a technical perspective, the vulnerability stems from improper validation or bounds checking when processing property references within the BACnet protocol implementation. The Confirmed WriteProperty request is a standard mechanism used to modify device properties remotely. However, the specific interaction between loop-1's controlled-variable-reference and life-safety-zone-1 accepted-modes triggers an unhandled exception or memory corruption event in older versions of the library. This indicates that the parser does not adequately verify the integrity or validity of cross-referenced objects before attempting to apply the write operation. The crash suggests a potential buffer overflow, null pointer dereference, or logic error that destabilizes the application state upon receiving this specific sequence of data.
The operational impact of this vulnerability is significant for facilities utilizing BACnet-based building management systems. A successful exploitation allows an attacker with network access to disrupt critical infrastructure services by crashing the server process. In a Building Automation and Control Network, such disruptions can lead to loss of environmental control, security system failures, or other safety-critical functions depending on how the system is configured. Since BACnet/IP operates over standard IP networks, this vulnerability could potentially be exploited remotely if the network segment containing the vulnerable device is accessible to untrusted hosts without adequate segmentation or firewall rules restricting BACnet traffic.
This issue aligns with CWE-20 Improper Input Validation and CWE-400 Uncontrolled Resource Consumption as it involves a failure to properly validate input data leading to system instability. In terms of MITRE ATT&CK, this vulnerability facilitates the Initial Access and Impact tactics by allowing an attacker to disrupt service availability through remote exploitation. The attack vector is classified as Network with Remote prerequisites, emphasizing the need for strict network access controls.
Mitigation strategies primarily involve upgrading the BACnet Stack library to version 1.4.4 or later where this flaw has been patched. For environments unable to immediately upgrade, implementing network segmentation to restrict BACnet/IP traffic to trusted subnets is recommended. Additionally, deploying intrusion detection systems capable of identifying anomalous BACnet packet structures can provide an additional layer of defense against exploitation attempts until the software update is applied.