CVE-2026-102612 · Package
NO FIX YET · SEE WHAT TO DO
BACnet Stack's Linux WebSocket hub loads a CA certificate but never requires clients to present one, so it accepts TLS connections from clients with no certificate. A network-reachable host can join the BACnet/SC mesh without credentials.
first public Oct 4, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Systems built on the BACnet Stack Linux WebSocket hub (ports/linux) for BACnet/SC networks. The flaw is in the hub's TLS server setup, so any deployment running that hub on a reachable network is exposed; deployments that do not use the Linux websocket hub are not affected.
Not affected if hub-not-used, patched-version
Who cares bacnet, bacnet-sc, building-automation, embedded, linux
ports/linux/websocket-srv.c for LWS_SERVER_OPTION_REQUIRE_VALID_OPENSSL_CLIENT_CERT in bws_srv_start(); if it is absent, the hub is affected.1.4.6, 1.5.2, 1.6.1, or 1.7.0, matching the release line you run.BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.6, 1.5.2, and 1.6.1, bws_srv_start() in ports/linux/websocket-srv.c builds the libwebsockets server context with a CA certificate loaded but never sets LWS_SERVER_OPTION_REQUIRE_VALID_OPENSSL_CLIENT_CERT, so the hub accepts TLS connections from clients presenting no certificate at all. Any network-reachable host can join the BACnet/SC mesh without credentials. This issue has been patched in versions 1.4.6, 1.5.2, 1.6.1, and 1.7.0.
This page as .md · .json · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.