{"resultsPerPage":52,"startIndex":0,"totalResults":52,"format":"NVD_CVE","version":"2.0","timestamp":"2026-10-23T18:04:37.393","vulnerabilities":[{"cve":{"id":"CVE-2010-4740","sourceIdentifier":"cve@mitre.org","published":"2011-02-16T03:00:03.633","lastModified":"2026-06-16T23:25:27.250","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Stack-based buffer overflow in WTclient.dll in SCADA Engine BACnet OPC Client before 1.0.25 allows user-assisted remote attackers to execute arbitrary code via a crafted .csv file, related to a status log message."},{"lang":"es","value":"Desbordamiento de búfer basado en pila en WTclient.dll en SCADA Engine BACnet OPC Client anterior a v1.0.25 permite a atacantes remotos asistidos por el usuario para ejecutar código de su elección a través de un archivo .csv manipulado, relacionado con un mensaje de registro de estado."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:C/I:C/A:C","baseScore":9.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":8.6,"impactScore":10.0,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-119"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:scadaengine:bacnet_opc_client:*:*:*:*:*:*:*:*","versionEndIncluding":"1.0.24","matchCriteriaId":"30CDC551-88ED-46F0-BBE5-4387D1E484EB"}]}]}],"references":[{"url":"http://packetstormsecurity.org/1009-exploits/bacnet-overflow.py.txt","source":"cve@mitre.org","tags":["Exploit"]},{"url":"http://secunia.com/advisories/41466","source":"cve@mitre.org","tags":["Vendor Advisory"]},{"url":"http://securityreason.com/securityalert/8083","source":"cve@mitre.org"},{"url":"http://www.kb.cert.org/vuls/id/660688","source":"cve@mitre.org","tags":["US Government Resource"]},{"url":"http://www.securityfocus.com/bid/43289","source":"cve@mitre.org","tags":["Exploit"]},{"url":"http://www.us-cert.gov/control_systems/pdf/ICSA-10-264-01.pdf","source":"cve@mitre.org","tags":["US Government Resource"]},{"url":"http://packetstormsecurity.org/1009-exploits/bacnet-overflow.py.txt","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"]},{"url":"http://secunia.com/advisories/41466","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]},{"url":"http://securityreason.com/securityalert/8083","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.kb.cert.org/vuls/id/660688","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["US Government Resource"]},{"url":"http://www.securityfocus.com/bid/43289","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"]},{"url":"http://www.us-cert.gov/control_systems/pdf/ICSA-10-264-01.pdf","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["US Government Resource"]}]}},{"cve":{"id":"CVE-2015-0979","sourceIdentifier":"ics-cert@hq.dhs.gov","published":"2015-03-14T01:59:11.877","lastModified":"2026-06-17T00:21:12.893","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Heap-based buffer overflow in the SOAP web interface in SCADA Engine BACnet OPC Server before 2.1.371.24 allows remote attackers to execute arbitrary code via a crafted packet."},{"lang":"es","value":"Desbordamiento de buffer basado en memoria en la interfaz web SOAP en SCADA Engine BACnet OPC Server anterior a 2.1.371.24 permite a atacantes remotos ejecutar código arbitrario a través de paquetes modificados."}],"affected":[{"source":"ics-cert@hq.dhs.gov","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:C","baseScore":9.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":8.5,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-119"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:scadaengine:bacnet_opc_server:*:*:*:*:*:*:*:*","versionEndIncluding":"2.1.359.22","matchCriteriaId":"48424CBB-866E-49AF-BEA6-B491DDE8632E"}]}]}],"references":[{"url":"https://ics-cert.us-cert.gov/advisories/ICSA-15-069-03","source":"ics-cert@hq.dhs.gov","tags":["Third Party Advisory","US Government Resource"]},{"url":"https://ics-cert.us-cert.gov/advisories/ICSA-15-069-03","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","US Government Resource"]}]}},{"cve":{"id":"CVE-2015-0980","sourceIdentifier":"ics-cert@hq.dhs.gov","published":"2015-03-14T01:59:12.797","lastModified":"2026-06-17T00:21:12.987","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Format string vulnerability in BACnOPCServer.exe in the SOAP web interface in SCADA Engine BACnet OPC Server before 2.1.371.24 allows remote attackers to execute arbitrary code via format string specifiers in a request."},{"lang":"es","value":"Vulnerabilidad de cadenas de formato en BACnOPCServer.exe en la interfaz web SOAP en SCADA Engine BACnet OPC Server anterior a 2.1.371.24 permite a atacantes remotos ejecutar código arbitrarios a través de una cadena con formato especificado en la petición."}],"affected":[{"source":"ics-cert@hq.dhs.gov","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:C","baseScore":9.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":8.5,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-20"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:scadaengine:bacnet_opc_server:*:*:*:*:*:*:*:*","versionEndIncluding":"2.1.359.22","matchCriteriaId":"48424CBB-866E-49AF-BEA6-B491DDE8632E"}]}]}],"references":[{"url":"https://ics-cert.us-cert.gov/advisories/ICSA-15-069-03","source":"ics-cert@hq.dhs.gov","tags":["Third Party Advisory","US Government Resource"]},{"url":"https://ics-cert.us-cert.gov/advisories/ICSA-15-069-03","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","US Government Resource"]}]}},{"cve":{"id":"CVE-2015-0981","sourceIdentifier":"ics-cert@hq.dhs.gov","published":"2015-03-14T01:59:13.720","lastModified":"2026-06-17T00:21:13.090","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"The SOAP web interface in SCADA Engine BACnet OPC Server before 2.1.371.24 allows remote attackers to bypass authentication and read or write to arbitrary database fields via unspecified vectors."},{"lang":"es","value":"La interfaz web SOAP en SCADA Engine BACnet OPC Server anterior a 2.1.371.24 permite a atacantes remotos evadir la autenticación y leer o escribir campos a una base de datos arbitraria a través de vectores no especificados."}],"affected":[{"source":"ics-cert@hq.dhs.gov","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-264"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:scadaengine:bacnet_opc_server:*:*:*:*:*:*:*:*","versionEndIncluding":"2.1.359.22","matchCriteriaId":"48424CBB-866E-49AF-BEA6-B491DDE8632E"}]}]}],"references":[{"url":"https://ics-cert.us-cert.gov/advisories/ICSA-15-069-03","source":"ics-cert@hq.dhs.gov","tags":["Third Party Advisory","US Government Resource"]},{"url":"https://ics-cert.us-cert.gov/advisories/ICSA-15-069-03","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","US Government Resource"]}]}},{"cve":{"id":"CVE-2015-4174","sourceIdentifier":"cve@mitre.org","published":"2015-06-28T10:59:02.363","lastModified":"2026-06-17T00:26:51.923","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Cross-site scripting (XSS) vulnerability in the integrated web server on the Siemens Climatix BACnet/IP communication module with firmware before 10.34 allows remote attackers to inject arbitrary web script or HTML via a crafted URL."},{"lang":"es","value":"Vulnerabilidad de XSS en el servidor web integrado en el módulo de comunicación Siemens Climatix BACnet/IP con firmware anterior a 10.34 permite a atacantes remotos inyectar secuencias de comandos web arbitrarios o HTML a través de una URL manipulada."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-79"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:siemens:climatix_bacnet\\/ip:*:*:*:*:*:*:*:*","versionEndIncluding":"10.33","matchCriteriaId":"670FD9A1-D6F3-486F-9D3E-165DA4AD52C6"}]}]}],"references":[{"url":"http://packetstormsecurity.com/files/132514/Climatix-BACnet-IP-Communication-Module-Cross-Site-Scripting.html","source":"cve@mitre.org","tags":["Exploit"]},{"url":"http://www.securityfocus.com/bid/75427","source":"cve@mitre.org"},{"url":"http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-142512.pdf","source":"cve@mitre.org","tags":["Patch","Vendor Advisory"]},{"url":"https://ics-cert.us-cert.gov/advisories/ICSA-15-176-01","source":"cve@mitre.org","tags":["Third Party Advisory","US Government Resource"]},{"url":"http://packetstormsecurity.com/files/132514/Climatix-BACnet-IP-Communication-Module-Cross-Site-Scripting.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"]},{"url":"http://www.securityfocus.com/bid/75427","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-142512.pdf","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Vendor Advisory"]},{"url":"https://ics-cert.us-cert.gov/advisories/ICSA-15-176-01","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","US Government Resource"]}]}},{"cve":{"id":"CVE-2017-9946","sourceIdentifier":"productcert@siemens.com","published":"2017-10-23T08:29:00.820","lastModified":"2026-06-17T01:29:15.747","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability has been identified in Siemens APOGEE PXC and TALON TC BACnet Automation Controllers in all versions = 1.5.0.rc1, <= 1.5.0.rc2","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-02-13T18:19:25.750164Z","id":"CVE-2026-21870","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-193"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:bacnetstack:bacnet_stack:*:*:*:*:*:*:*:*","versionEndIncluding":"1.4.2","matchCriteriaId":"3BF2BFCC-54CE-412E-947A-B5C834161829"},{"vulnerable":true,"criteria":"cpe:2.3:a:bacnetstack:bacnet_stack:1.5.0:rc1:*:*:*:*:*:*","matchCriteriaId":"2B47182E-6B7F-4C53-904A-EB37C9C0A439"},{"vulnerable":true,"criteria":"cpe:2.3:a:bacnetstack:bacnet_stack:1.5.0:rc2:*:*:*:*:*:*","matchCriteriaId":"CF491863-1A31-4A23-A6AC-DF7545FCAA48"}]}]}],"references":[{"url":"https://github.com/bacnet-stack/bacnet-stack/commit/4e1176394a5ae50d2fd0b5790d9bff806dc08465","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/bacnet-stack/bacnet-stack/pull/1196","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-pc83-wp6w-93mx","source":"security-advisories@github.com","tags":["Exploit","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-21878","sourceIdentifier":"security-advisories@github.com","published":"2026-02-13T19:17:28.650","lastModified":"2026-06-17T10:19:04.633","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to 1.5.0.rc3, a vulnerability has been discovered in BACnet Stack's file writing functionality where there is no validation of user-provided file paths, allowing attackers to write files to arbitrary directories. This affects apps/readfile/main.c and ports/posix/bacfile-posix.c. This vulnerability is fixed in 1.5.0.rc3."},{"lang":"es","value":"BACnet Stack es una librería C de pila de protocolos BACnet de código abierto para sistemas embebidos. Antes de la versión 1.5.0.rc3, se ha descubierto una vulnerabilidad en la funcionalidad de escritura de archivos de BACnet Stack donde no hay validación de las rutas de archivo proporcionadas por el usuario, lo que permite a los atacantes escribir archivos en directorios arbitrarios. Esto afecta a apps/readfile/main.c y ports/posix/bacfile-posix.c. Esta vulnerabilidad está corregida en la versión 1.5.0.rc3."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"bacnet-stack","product":"bacnet-stack","versions":[{"version":"< 1.5.0.rc3","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-02-13T18:53:41.608462Z","id":"CVE-2026-21878","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:bacnetstack:bacnet_stack:1.5.0:rc1:*:*:*:*:*:*","matchCriteriaId":"2B47182E-6B7F-4C53-904A-EB37C9C0A439"},{"vulnerable":true,"criteria":"cpe:2.3:a:bacnetstack:bacnet_stack:1.5.0:rc2:*:*:*:*:*:*","matchCriteriaId":"CF491863-1A31-4A23-A6AC-DF7545FCAA48"}]}]}],"references":[{"url":"https://github.com/bacnet-stack/bacnet-stack/commit/c5dc00a77b4bc2550befa67a930b333e299c18f3","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-p8rx-c26w-545j","source":"security-advisories@github.com","tags":["Exploit","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-26264","sourceIdentifier":"security-advisories@github.com","published":"2026-02-13T19:17:31.143","lastModified":"2026-06-17T10:26:00.427","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to 1.5.0rc4 and 1.4.3rc2, a malformed WriteProperty request can trigger a length underflow in the BACnet stack, leading to an out‑of‑bounds read and a crash (DoS). The issue is in wp.c within wp_decode_service_request. When decoding the optional priority context tag, the code passes apdu_len - apdu_size to bacnet_unsigned_context_decode without validating that apdu_size <= apdu_len. If a truncated APDU reaches this path, apdu_len - apdu_size underflows, resulting in a large size being used for decoding and an out‑of‑bounds read. This vulnerability is fixed in 1.5.0rc4 and 1.4.3rc2."},{"lang":"es","value":"BACnet Stack es una librería C de pila de protocolo de código abierto BACnet para sistemas embebidos. Antes de 1.5.0rc4 y 1.4.3rc2, una solicitud WriteProperty malformada puede desencadenar un desbordamiento negativo de longitud en la pila BACnet, lo que lleva a una lectura fuera de límites y un fallo (DoS). El problema está en wp.c dentro de wp_decode_service_request. Al decodificar la etiqueta de contexto de prioridad opcional, el código pasa apdu_len - apdu_size a bacnet_unsigned_context_decode sin validar que apdu_size <= apdu_len. Si una APDU truncada alcanza esta ruta, apdu_len - apdu_size sufre un desbordamiento negativo, lo que resulta en un tamaño grande siendo utilizado para la decodificación y una lectura fuera de límites. Esta vulnerabilidad está corregida en 1.5.0rc4 y 1.4.3rc2."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"bacnet-stack","product":"bacnet-stack","versions":[{"version":">= 1.5.0rc1, < 1.5.0rc4","status":"affected"},{"version":"< 1.4.3rc2","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-02-13T18:49:44.498242Z","id":"CVE-2026-26264","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-125"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:bacnetstack:bacnet_stack:*:*:*:*:*:*:*:*","versionStartIncluding":"1.4.0","versionEndExcluding":"1.4.3","matchCriteriaId":"9BAD4B36-9061-453C-9C23-231993F1E69E"},{"vulnerable":true,"criteria":"cpe:2.3:a:bacnetstack:bacnet_stack:1.4.3:rc1:*:*:*:*:*:*","matchCriteriaId":"F4D20F1C-637A-4398-AD64-43C05692782D"},{"vulnerable":true,"criteria":"cpe:2.3:a:bacnetstack:bacnet_stack:1.5.0:rc1:*:*:*:*:*:*","matchCriteriaId":"2B47182E-6B7F-4C53-904A-EB37C9C0A439"},{"vulnerable":true,"criteria":"cpe:2.3:a:bacnetstack:bacnet_stack:1.5.0:rc2:*:*:*:*:*:*","matchCriteriaId":"CF491863-1A31-4A23-A6AC-DF7545FCAA48"},{"vulnerable":true,"criteria":"cpe:2.3:a:bacnetstack:bacnet_stack:1.5.0:rc3:*:*:*:*:*:*","matchCriteriaId":"DAB57C9E-9ABF-41FD-8D30-7C319ED23227"}]}]}],"references":[{"url":"https://github.com/bacnet-stack/bacnet-stack/commit/4cc8067c86f26e2b08b2c8f4d27f8e07de4d4708","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-phjh-v45p-gmjj","source":"security-advisories@github.com","tags":["Exploit","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2025-41765","sourceIdentifier":"info@cert.vde.com","published":"2026-03-09T09:16:00.987","lastModified":"2026-06-17T09:23:07.987","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Due to insufficient authorization enforcement, an unauthorized remote attacker can exploit the wwwupload.cgi endpoint to upload and apply arbitrary data. This includes, but is not limited to, contact images, HTTPS certificates, system backups for restoration, server peer configurations, and BACnet/SC server certificates and keys."},{"lang":"es","value":"Debido a una aplicación de autorización insuficiente, un atacante remoto no autorizado puede explotar el endpoint wwwupload.cgi para cargar y aplicar datos arbitrarios. Esto incluye, pero no se limita a, imágenes de contacto, certificados HTTPS, copias de seguridad del sistema para restauración, configuraciones de pares de servidor, y certificados y claves de servidor BACnet/SC."}],"affected":[{"source":"info@cert.vde.com","affectedData":[{"vendor":"MBS","product":"UBR-01 Mk II","defaultStatus":"unaffected","versions":[{"version":"0.0.0","lessThan":"6.0.1.0","versionType":"semver","status":"affected"}]},{"vendor":"MBS","product":"UBR-02","defaultStatus":"unaffected","versions":[{"version":"0.0.0","lessThan":"6.0.1.0","versionType":"semver","status":"affected"}]},{"vendor":"MBS","product":"UBR-LON","defaultStatus":"unaffected","versions":[{"version":"0.0.0","lessThan":"6.0.1.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"info@cert.vde.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-03-09T20:03:25.311007Z","id":"CVE-2025-41765","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"info@cert.vde.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mbs-solutions:universal_bacnet_router_firmware:*:*:*:*:*:*:*:*","versionEndExcluding":"6.0.1.0","matchCriteriaId":"D4E2B246-5465-41DB-BD9A-1533A7508790"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mbs-solutions:ubr-01_mk_ii:-:*:*:*:*:*:*:*","matchCriteriaId":"0D812069-6738-4B82-992B-09BB239783AB"},{"vulnerable":false,"criteria":"cpe:2.3:h:mbs-solutions:ubr-02:-:*:*:*:*:*:*:*","matchCriteriaId":"B21413DE-E1FA-4B5C-A415-F8E70D7090BF"},{"vulnerable":false,"criteria":"cpe:2.3:h:mbs-solutions:ubr-lon:-:*:*:*:*:*:*:*","matchCriteriaId":"E0C67EAC-C633-4037-B2C4-965455FFF2A0"}]}]}],"references":[{"url":"https://www.mbs-solutions.de/mbs-2025-0001","source":"info@cert.vde.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-24060","sourceIdentifier":"ics-cert@hq.dhs.gov","published":"2026-03-21T00:16:25.483","lastModified":"2026-06-17T10:22:32.310","vulnStatus":"Awaiting Analysis","cveTags":[{"sourceIdentifier":"ics-cert@hq.dhs.gov","tags":["unsupported-when-assigned"]}],"descriptions":[{"lang":"en","value":"Service information is not encrypted when transmitted as BACnet packets \nover the wire, and can be sniffed, intercepted, and modified by an \nattacker. Valuable information such as the File Start Position and File \nData can be sniffed from network traffic using Wireshark's BACnet \ndissector filter. The proprietary format used by WebCTRL to receive \nupdates from the PLC can also be sniffed and reverse engineered."},{"lang":"es","value":"La información de servicio no está cifrada cuando se transmite como paquetes BACnet a través de la red, y puede ser olfateada, interceptada y modificada por un atacante. Información valiosa como la Posición de Inicio del Archivo y los Datos del Archivo puede ser olfateada del tráfico de red utilizando el filtro disector BACnet de Wireshark. El formato propietario utilizado por WebCTRL para recibir actualizaciones del PLC también puede ser olfateado y sometido a ingeniería inversa."}],"affected":[{"source":"ics-cert@hq.dhs.gov","affectedData":[{"vendor":"Automated Logic","product":"WebCTRL Premium Server","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"v8.5","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"ics-cert@hq.dhs.gov","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-03-23T14:49:21.420075Z","id":"CVE-2026-24060","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"ics-cert@hq.dhs.gov","type":"Secondary","description":[{"lang":"en","value":"CWE-319"}]},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-319"}]}],"references":[{"url":"https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-078-08.json","source":"ics-cert@hq.dhs.gov"},{"url":"https://www.automatedlogic.com/en/company/security-commitment/","source":"ics-cert@hq.dhs.gov"},{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-078-08","source":"ics-cert@hq.dhs.gov"}]}},{"cve":{"id":"CVE-2026-32666","sourceIdentifier":"ics-cert@hq.dhs.gov","published":"2026-03-21T00:16:26.220","lastModified":"2026-06-17T10:36:11.007","vulnStatus":"Awaiting Analysis","cveTags":[{"sourceIdentifier":"ics-cert@hq.dhs.gov","tags":["unsupported-when-assigned"]}],"descriptions":[{"lang":"en","value":"WebCTRL systems that communicate over BACnet inherit the protocol's lack\n of network layer authentication. WebCTRL does not implement additional \nvalidation of BACnet traffic so an attacker with network access could \nspoof BACnet packets directed at either the WebCTRL server or associated\n AutomatedLogic controllers. Spoofed packets may be processed as \nlegitimate."},{"lang":"es","value":"Los sistemas WebCTRL que se comunican a través de BACnet heredan la falta de autenticación de capa de red del protocolo. WebCTRL no implementa validación adicional del tráfico BACnet, por lo que un atacante con acceso a la red podría falsificar paquetes BACnet dirigidos tanto al servidor WebCTRL como a los controladores AutomatedLogic asociados. Los paquetes falsificados pueden ser procesados como legítimos."}],"affected":[{"source":"ics-cert@hq.dhs.gov","affectedData":[{"vendor":"Automated Logic","product":"WebCTRL Premium Server","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"v8.5","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"ics-cert@hq.dhs.gov","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-03-23T14:49:42.712836Z","id":"CVE-2026-32666","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"ics-cert@hq.dhs.gov","type":"Secondary","description":[{"lang":"en","value":"CWE-290"}]},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-290"}]}],"references":[{"url":"https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-078-08.json","source":"ics-cert@hq.dhs.gov"},{"url":"https://www.automatedlogic.com/en/company/security-commitment/","source":"ics-cert@hq.dhs.gov"},{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-078-08","source":"ics-cert@hq.dhs.gov"}]}},{"cve":{"id":"CVE-2026-40279","sourceIdentifier":"security-advisories@github.com","published":"2026-04-21T17:16:54.853","lastModified":"2026-06-17T10:44:56.177","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to 1.4.3, decode_signed32() in src/bacnet/bacint.c reconstructs a 32-bit signed integer from four APDU bytes using signed left shifts. When any of the four bytes has bit 7 set (value ≥ 0x80), the left-shift operation overflows a signed int32_t, which is undefined behavior per the C standard. This is flagged thousands of times per minute by UndefinedBehaviorSanitizer on any BACnet input containing signed-integer property values with high-bit-set bytes. This vulnerability is fixed in 1.4.3."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"bacnet-stack","product":"bacnet-stack","versions":[{"version":"< 1.4.3","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","baseScore":3.7,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":2.2,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-04-21T19:18:55.401000Z","id":"CVE-2026-40279","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-758"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:bacnetstack:bacnet_stack:*:*:*:*:*:*:*:*","versionEndExcluding":"1.4.3","matchCriteriaId":"B46C7C2C-2BC3-4A72-AEDC-746D4D76A2DE"}]}]}],"references":[{"url":"https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-326g-j95f-gmxv","source":"security-advisories@github.com","tags":["Exploit","Mitigation","Vendor Advisory"]},{"url":"https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-326g-j95f-gmxv","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Mitigation","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-41475","sourceIdentifier":"security-advisories@github.com","published":"2026-04-24T20:16:28.063","lastModified":"2026-06-17T10:46:46.073","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to 1.4.3, an out-of-bounds read vulnerability in bacnet-stack's WritePropertyMultiple service decoder allows unauthenticated remote attackers to read past allocated buffer boundaries by sending a truncated WPM request. The vulnerability stems from wpm_decode_object_property() calling the deprecated decode_tag_number_and_value() function, which performs no bounds checking on the input buffer. A crafted BACnet/IP packet with a truncated property payload causes the decoder to read 1-7 bytes past the end of the buffer, leading to crashes or information disclosure on embedded BACnet devices. This vulnerability is fixed in 1.4.3."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"bacnet-stack","product":"bacnet-stack","versions":[{"version":">= 1.4.0, < 1.4.3","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-04-27T13:41:30.868232Z","id":"CVE-2026-41475","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-125"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:bacnetstack:bacnet_stack:*:*:*:*:*:*:*:*","versionStartIncluding":"1.4.0","versionEndExcluding":"1.4.3","matchCriteriaId":"9BAD4B36-9061-453C-9C23-231993F1E69E"},{"vulnerable":true,"criteria":"cpe:2.3:a:bacnetstack:bacnet_stack:1.5.0:rc1:*:*:*:*:*:*","matchCriteriaId":"2B47182E-6B7F-4C53-904A-EB37C9C0A439"},{"vulnerable":true,"criteria":"cpe:2.3:a:bacnetstack:bacnet_stack:1.5.0:rc2:*:*:*:*:*:*","matchCriteriaId":"CF491863-1A31-4A23-A6AC-DF7545FCAA48"},{"vulnerable":true,"criteria":"cpe:2.3:a:bacnetstack:bacnet_stack:1.5.0:rc3:*:*:*:*:*:*","matchCriteriaId":"DAB57C9E-9ABF-41FD-8D30-7C319ED23227"}]}]}],"references":[{"url":"https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-cvv4-v3g6-4jmv","source":"security-advisories@github.com","tags":["Exploit","Mitigation","Vendor Advisory"]},{"url":"https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-cvv4-v3g6-4jmv","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Mitigation","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-41502","sourceIdentifier":"security-advisories@github.com","published":"2026-04-24T20:16:28.563","lastModified":"2026-06-17T10:46:48.587","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to 1.4.3, an off-by-one out-of-bounds read vulnerability in bacnet-stack's ReadPropertyMultiple service decoder allows unauthenticated remote attackers to read one byte past an allocated buffer boundary by sending a crafted RPM request with a truncated object identifier. The vulnerability is in rpm_decode_object_id(), which checks apdu_len < 5 but then accesses all 6 byte positions (indices 0-5) — consuming 1 byte for the context tag, 4 bytes for the object ID, then reading apdu[5] for the opening tag check. A 5-byte input passes the length check but causes a 1-byte OOB read, leading to crashes on embedded BACnet devices. The vulnerability exists in src/bacnet/rpm.c and affects any deployment that enables the ReadPropertyMultiple confirmed service handler (enabled by default in the reference server). This vulnerability is fixed in 1.4.3."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"bacnet-stack","product":"bacnet-stack","versions":[{"version":">= 1.4.0, < 1.4.3","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-04-25T01:53:27.434002Z","id":"CVE-2026-41502","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-125"},{"lang":"en","value":"CWE-193"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:bacnetstack:bacnet_stack:*:*:*:*:*:*:*:*","versionStartIncluding":"1.4.0","versionEndExcluding":"1.4.3","matchCriteriaId":"9BAD4B36-9061-453C-9C23-231993F1E69E"},{"vulnerable":true,"criteria":"cpe:2.3:a:bacnetstack:bacnet_stack:1.5.0:rc1:*:*:*:*:*:*","matchCriteriaId":"2B47182E-6B7F-4C53-904A-EB37C9C0A439"},{"vulnerable":true,"criteria":"cpe:2.3:a:bacnetstack:bacnet_stack:1.5.0:rc2:*:*:*:*:*:*","matchCriteriaId":"CF491863-1A31-4A23-A6AC-DF7545FCAA48"},{"vulnerable":true,"criteria":"cpe:2.3:a:bacnetstack:bacnet_stack:1.5.0:rc3:*:*:*:*:*:*","matchCriteriaId":"DAB57C9E-9ABF-41FD-8D30-7C319ED23227"}]}]}],"references":[{"url":"https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-7545-3fpx-4xw3","source":"security-advisories@github.com","tags":["Exploit","Mitigation","Vendor Advisory"]},{"url":"https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-7545-3fpx-4xw3","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Mitigation","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-41503","sourceIdentifier":"security-advisories@github.com","published":"2026-04-24T20:16:28.697","lastModified":"2026-06-17T10:46:48.700","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to 1.4.3, an out-of-bounds read vulnerability in bacnet-stack's ReadPropertyMultiple service property decoder allows unauthenticated remote attackers to read past allocated buffer boundaries by sending an RPM request with a truncated property list. The vulnerability stems from rpm_decode_object_property() calling the deprecated decode_tag_number_and_value() function at src/bacnet/rpm.c:344, which accepts no buffer length parameter and reads blindly from whatever pointer it receives. A crafted BACnet/IP packet with a 1-byte property payload containing an extended tag marker (0xF9) causes the decoder to read 1 byte past the end of the buffer, leading to crashes on embedded BACnet devices. The vulnerability exists in src/bacnet/rpm.c and affects any deployment that enables the ReadPropertyMultiple confirmed service handler (enabled by default in the reference server). This vulnerability is fixed in 1.4.3."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"bacnet-stack","product":"bacnet-stack","versions":[{"version":">= 1.4.0, < 1.4.3","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-04-27T13:39:52.930841Z","id":"CVE-2026-41503","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-125"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:bacnetstack:bacnet_stack:*:*:*:*:*:*:*:*","versionStartIncluding":"1.4.0","versionEndExcluding":"1.4.3","matchCriteriaId":"9BAD4B36-9061-453C-9C23-231993F1E69E"},{"vulnerable":true,"criteria":"cpe:2.3:a:bacnetstack:bacnet_stack:1.5.0:rc1:*:*:*:*:*:*","matchCriteriaId":"2B47182E-6B7F-4C53-904A-EB37C9C0A439"}]}]}],"references":[{"url":"https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-5w2v-mwqj-pr2c","source":"security-advisories@github.com","tags":["Exploit","Mitigation","Vendor Advisory"]},{"url":"https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-5w2v-mwqj-pr2c","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Mitigation","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-38570","sourceIdentifier":"cve@mitre.org","published":"2026-06-04T16:16:35.923","lastModified":"2026-07-22T20:10:00.127","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"bacnet_stack 1.3.1 contains an Out-of-bounds Read in bacnet_tag_number_decode which allows attackers to cause a denial of service."},{"lang":"es","value":"bacnet_stack 1.3.1 contiene una Lectura fuera de límites en bacnet_tag_number_decode lo que permite a los atacantes causar una denegación de servicio."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-06-08T14:14:15.479241Z","id":"CVE-2026-38570","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-125"}]}],"references":[{"url":"https://github.com/bacnet-stack/bacnet-stack","source":"cve@mitre.org"},{"url":"https://github.com/bacnet-stack/bacnet-stack/issues/1270","source":"cve@mitre.org"}]}},{"cve":{"id":"CVE-2026-55732","sourceIdentifier":"vulnerability@ncsc.ch","published":"2026-07-24T15:18:31.543","lastModified":"2026-07-27T20:32:11.620","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Out-of-bounds Read (CWE-125) in BACnet packet parsing (`bacdt_datetime_to_tod`) in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.18 on LINX-A64 allows an unauthenticated remote attacker to crash `linx_a64.exe` and ultimately reboot the device via a malformed BACnet TimeSynchronization or UTC-TimeSynchronization packet with an invalid month value. The same vulnerability affects multiple other Loytec products."}],"affected":[{"source":"vulnerability@ncsc.ch","affectedData":[{"vendor":"Loytec","product":"LIP-ME20xC","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"8.4.18","versionType":"custom","status":"affected"}]},{"vendor":"Loytec","product":"L-INX","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"8.4.18","versionType":"custom","status":"affected"}]},{"vendor":"Loytec","product":"L-GATE","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"8.4.18","versionType":"custom","status":"affected"}]},{"vendor":"Loytec","product":"L-ROC","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"8.4.18","versionType":"custom","status":"affected"}]},{"vendor":"Loytec","product":"L-IOB","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"8.4.18","versionType":"custom","status":"affected"}]},{"vendor":"Loytec","product":"L-DALI","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"8.4.18","versionType":"custom","status":"affected"}]},{"vendor":"Loytec","product":"L-VIS","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"8.4.18","versionType":"custom","status":"affected"}]},{"vendor":"Loytec","product":"L-PAD","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"8.4.18","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"vulnerability@ncsc.ch","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-07-24T14:53:38.766440Z","id":"CVE-2026-55732","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"vulnerability@ncsc.ch","type":"Secondary","description":[{"lang":"en","value":"CWE-125"}]}],"references":[{"url":"https://www.loytec.com/support/product-security/advisories/8532-dibt-cve-20260608-0001-bacnet-crash-due-to-invalid-timesync-message-high","source":"vulnerability@ncsc.ch"}]}},{"cve":{"id":"CVE-2026-59693","sourceIdentifier":"productcert@siemens.com","published":"2026-08-11T13:19:00.477","lastModified":"2026-08-28T19:03:37.837","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability has been identified in Desigo DXR2 (All versions < V01.21.233.16-7862), Desigo PXC3 (All versions < V01.21.233.16-7862), Desigo PXC4 (All versions < V02.21.194.36-2715), Desigo PXC5.E003 (All versions < V02.21.194.36-2715), Desigo PXC5.E24 (All versions < V02.21.194.36-2715), Desigo PXC7 (All versions < V02.21.194.36-2715). The affected devices are vulnerable to a denial-of-service (DoS) vulnerability. An attacker can exploit this issue by sending a malformed BACnet packet, causing the device to stop responding to BACnet queries. Recovery requires a device reset or reboot to restore normal functionality."}],"affected":[{"source":"productcert@siemens.com","affectedData":[{"vendor":"Siemens","product":"Desigo DXR2","defaultStatus":"unknown","versions":[{"version":"0","lessThan":"V01.21.233.16-7862","versionType":"custom","status":"affected"}]},{"vendor":"Siemens","product":"Desigo PXC3","defaultStatus":"unknown","versions":[{"version":"0","lessThan":"V01.21.233.16-7862","versionType":"custom","status":"affected"}]},{"vendor":"Siemens","product":"Desigo PXC4","defaultStatus":"unknown","versions":[{"version":"0","lessThan":"V02.21.194.36-2715","versionType":"custom","status":"affected"}]},{"vendor":"Siemens","product":"Desigo PXC5.E003","defaultStatus":"unknown","versions":[{"version":"0","lessThan":"V02.21.194.36-2715","versionType":"custom","status":"affected"}]},{"vendor":"Siemens","product":"Desigo PXC5.E24","defaultStatus":"unknown","versions":[{"version":"0","lessThan":"V02.21.194.36-2715","versionType":"custom","status":"affected"}]},{"vendor":"Siemens","product":"Desigo PXC7","defaultStatus":"unknown","versions":[{"version":"0","lessThan":"V02.21.194.36-2715","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"productcert@siemens.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"ADJACENT","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"productcert@siemens.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-11T18:08:48.569650Z","id":"CVE-2026-59693","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"productcert@siemens.com","type":"Secondary","description":[{"lang":"en","value":"CWE-754"}]}],"references":[{"url":"https://cert-portal.siemens.com/productcert/html/ssa-781903.html","source":"productcert@siemens.com"}]}},{"cve":{"id":"CVE-2025-41753","sourceIdentifier":"info@cert.vde.com","published":"2026-10-01T07:16:32.473","lastModified":"2026-10-14T13:10:00.187","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"The object name of a dynamically created BACnet File Object is interpreted as a file path without sufficient validation. Because relative paths are not limited to the intended directory, an unauthenticated remote attacker can traverse outside of it and read or overwrite arbitrary files on the device, which may lead to full system compromise."},{"lang":"es","value":"El nombre del objeto de un objeto de archivo BACnet creado dinámicamente se interpreta como una ruta de archivo sin validación suficiente. Debido a que las rutas relativas no están limitadas al directorio previsto, un atacante remoto no autenticado puede atravesar fuera de él y leer o sobrescribir archivos arbitrarios en el dispositivo, lo que puede llevar a un compromiso total del sistema."}],"affected":[{"source":"info@cert.vde.com","affectedData":[{"vendor":"WAGO","product":"0751-9x01","defaultStatus":"unaffected","versions":[{"version":"1.0.0","lessThan":"4.8.9","versionType":"semver","status":"affected"}]},{"vendor":"WAGO","product":"0750-811x-xxxx-xxxx","defaultStatus":"unaffected","versions":[{"version":"1.0.0","lessThan":"4.8.9","versionType":"semver","status":"affected"}]},{"vendor":"WAGO","product":"0750-821x-xxx-xxx","defaultStatus":"unaffected","versions":[{"version":"1.0.0","lessThan":"4.8.9","versionType":"semver","status":"affected"}]},{"vendor":"WAGO","product":"0762-420x-8000-000x","defaultStatus":"unaffected","versions":[{"version":"1.0.0","lessThan":"4.8.9","versionType":"semver","status":"affected"}]},{"vendor":"WAGO","product":"0762-430x-8000-000x","defaultStatus":"unaffected","versions":[{"version":"1.0.0","lessThan":"4.8.9","versionType":"semver","status":"affected"}]},{"vendor":"WAGO","product":"0762-520x-8000-000x","defaultStatus":"unaffected","versions":[{"version":"1.0.0","lessThan":"4.8.9","versionType":"semver","status":"affected"}]},{"vendor":"WAGO","product":"0762-530x-8000-000x","defaultStatus":"unaffected","versions":[{"version":"1.0.0","lessThan":"4.8.9","versionType":"semver","status":"affected"}]},{"vendor":"WAGO","product":"0762-620x-8000-000x","defaultStatus":"unaffected","versions":[{"version":"1.0.0","lessThan":"4.8.9","versionType":"semver","status":"affected"}]},{"vendor":"WAGO","product":"0762-630x-8000-000x","defaultStatus":"unaffected","versions":[{"version":"1.0.0","lessThan":"4.8.9","versionType":"semver","status":"affected"}]},{"vendor":"WAGO","product":"0752-8303-8000-0002","defaultStatus":"unaffected","versions":[{"version":"1.0.0","lessThan":"4.8.9","versionType":"semver","status":"affected"}]},{"vendor":"WAGO","product":"0762-340x","defaultStatus":"unaffected","versions":[{"version":"1.0.0","lessThan":"4.8.9","versionType":"semver","status":"affected"}]},{"vendor":"WAGO","product":"0751-9x01","defaultStatus":"unaffected","versions":[{"version":"1.0.0","lessThan":"4.8.9 (70)","versionType":"semver","status":"affected"}]},{"vendor":"WAGO","product":"0750-811x-xxxx-xxxx","defaultStatus":"unaffected","versions":[{"version":"1.0.0","lessThan":"4.8.9 (70)","versionType":"semver","status":"affected"}]},{"vendor":"WAGO","product":"0750-821x-xxx-xxx","defaultStatus":"unaffected","versions":[{"version":"1.0.0","lessThan":"4.8.9 (70)","versionType":"semver","status":"affected"}]},{"vendor":"WAGO","product":"0762-420x-8000-000x","defaultStatus":"unaffected","versions":[{"version":"1.0.0","lessThan":"4.8.9 (70)","versionType":"semver","status":"affected"}]},{"vendor":"WAGO","product":"0762-430x-8000-000x","defaultStatus":"unaffected","versions":[{"version":"1.0.0","lessThan":"4.8.9 (70)","versionType":"semver","status":"affected"}]},{"vendor":"WAGO","product":"0762-520x-8000-000x","defaultStatus":"unaffected","versions":[{"version":"1.0.0","lessThan":"4.8.9 (70)","versionType":"semver","status":"affected"}]},{"vendor":"WAGO","product":"0762-530x-8000-000x","defaultStatus":"unaffected","versions":[{"version":"1.0.0","lessThan":"4.8.9 (70)","versionType":"semver","status":"affected"}]},{"vendor":"WAGO","product":"0762-620x-8000-000x","defaultStatus":"unaffected","versions":[{"version":"1.0.0","lessThan":"4.8.9 (70)","versionType":"semver","status":"affected"}]},{"vendor":"WAGO","product":"0762-630x-8000-000x","defaultStatus":"unaffected","versions":[{"version":"1.0.0","lessThan":"4.8.9 (70)","versionType":"semver","status":"affected"}]},{"vendor":"WAGO","product":"0752-8303-8000-0002","defaultStatus":"unaffected","versions":[{"version":"1.0.0","lessThan":"4.8.9 (70)","versionType":"semver","status":"affected"}]},{"vendor":"WAGO","product":"0762-340x","defaultStatus":"unaffected","versions":[{"version":"1.0.0","lessThan":"4.8.9 (70)","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"info@cert.vde.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.3,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"info@cert.vde.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-01T19:11:00.419667Z","id":"CVE-2025-41753","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"info@cert.vde.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://www.certvde.com/en/advisories/VDE-2025-102/","source":"info@cert.vde.com"}]}}]}