PT-2026-146047

CVE-2026-47711

Published

2026-11-12

Updated

2026-11-12

Description by

CVSS 3.1

8.6

High

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

Name of the Vulnerable Software and Affected Versions BACnet Stack versions prior to 1.4.4 BACnet Stack versions prior to 1.5.1 BACnet Stack versions prior to 1.6.0

Description The master demo server can be crashed remotely via BACnet/IP. This occurs when a valid Confirmed WriteProperty request is sent to update the controlled-variable-reference of loop-1 to point to life-safety-zone-1 / accepted-modes.

Recommendations Update to version 1.4.4 Update to version 1.5.1 Update to version 1.6.0

Exploitability

Exploit

Fix

Impacts

Vendors

Affected products

Weakness enumeration

CWE-787: Out-of-bounds Write

CWE-121: Stack-based Buffer Overflow

CWE-131: Incorrect Calculation of Buffer Size

CWE-805: Buffer Access with Incorrect Length Value