CVE-2026-102537 · Package
NO FIX YET · SEE WHAT TO DO
The BACnet Stack Linux WebSocket client accepts any self-signed certificate from a hub, even when it does not chain to the trusted CA. An attacker running a rogue hub can receive the node's identity and all later BACnet traffic.
first public Oct 4, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Only builds that use the Linux WebSocket client in ports/linux/websocket-cli.c, which is used by BACnet/SC nodes. Systems that run other BACnet ports or do not use BACnet/SC are not described as affected. Teams that embed the library in BACnet/SC devices should check their version against the fixed releases.
Not affected if fixed-version, no-bacnet-sc, non-linux-port
Who cares bacnet, bacnet-sc, embedded, libwebsockets, linux
ports/linux/websocket-cli.c in the build and confirm whether LCCSCF_ALLOW_SELFSIGNED is set in bws_cli_connect().1.4.6, 1.5.2, 1.6.1, or 1.7.0, the versions the description names as patched.BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.6, 1.5.2, and 1.6.1, bws_cli_connect() in ports/linux/websocket-cli.c loads the trusted CA cert into the libwebsockets context, then always sets LCCSCF_ALLOW_SELFSIGNED in the connection flags. So lws accepts any self-signed hub certificate, whether or not it chains to the loaded CA. A BACnet/SC node finishes the TLS handshake to a rogue hub that presents a self-signed cert. It then hands the attacker its identity (VMAC, UUID) and all later BACnet traffic. This issue has been patched in versions 1.4.6, 1.5.2, 1.6.1, and 1.7.0.
This page as .md · .json · CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.