Description
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. In versions 1.5.0 and 1.6.0-rc1, there is a restore logic flaw in bacnet-stack that is reachable through the official, unmodified apps/server management path when BACNET_BACKUP_RESTORE is enabled. This issue has been patched in versions 1.5.1 and 1.6.0.
Published: 2026-11-12
Score: 8.1 High
EPSS: n/a
KEV: No
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No solution or workaround provided in the CVE record.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 12 Nov 2026 20:15:00 +0000

Type Values Removed Values Added
Description BACnet Stack is a BACnet open source protocol stack C library for embedded systems. In versions 1.5.0 and 1.6.0-rc1, there is a restore logic flaw in bacnet-stack that is reachable through the official, unmodified apps/server management path when BACNET_BACKUP_RESTORE is enabled. This issue has been patched in versions 1.5.1 and 1.6.0.
Title BACnet Stack: ReinitializeDevice ENDRESTORE can delete existing objects on an empty restore file and still return success
Weaknesses CWE-670
CWE-754
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-11-12T20:01:37.984Z

Reserved: 2026-05-18T23:03:37.228Z

Link: CVE-2026-47257

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-11-12T20:18:40.020

Modified: 2026-11-12T20:18:40.020

Link: CVE-2026-47257

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses
  • CWE-670

    Always-Incorrect Control Flow Implementation

  • CWE-754

    Improper Check for Unusual or Exceptional Conditions