{"id":"CVE-2026-102612","kind":"vulnerability","aliases":["CVE-2026-102612"],"related":[],"title":"BACnet Stack: missing client certificate check lets anyone join the mesh","description":"BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.6, 1.5.2, and 1.6.1, bws_srv_start() in ports/linux/websocket-srv.c builds the libwebsockets server context with a CA certificate loaded but never sets LWS_SERVER_OPTION_REQUIRE_VALID_OPENSSL_CLIENT_CERT, so the hub accepts TLS connections from clients presenting no certificate at all. Any network-reachable host can join the BACnet/SC mesh without credentials. This issue has been patched in versions 1.4.6, 1.5.2, 1.6.1, and 1.7.0.","summary":"BACnet Stack's Linux WebSocket hub loads a CA certificate but never requires clients to present one, so it accepts TLS connections from clients with no certificate. A network-reachable host can join the BACnet/SC mesh without credentials.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bacnet","bacnet-sc","building-automation","embedded","linux","package"],"not_affected_if":["hub-not-used","patched-version"],"how_to_check":"- Check the installed BACnet Stack version against the fixed versions listed below.\n- Look in `ports/linux/websocket-srv.c` for `LWS_SERVER_OPTION_REQUIRE_VALID_OPENSSL_CLIENT_CERT` in `bws_srv_start()`; if it is absent, the hub is affected.","fix":"- BACnet Stack `1.4.6`, `1.5.2`, `1.6.1`, or `1.7.0`, matching the release line you run.","status":"open","published_at":"2026-11-13T19:17:37+00:00","first_seen_at":"2026-11-13T19:52:09+00:00","triaged_at":"2026-11-13T19:54:04+00:00","updated_at":"2026-11-13T19:54:04+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-13T19:54:04Z","model":"claude-haiku-5-5","output":{"fix":"- BACnet Stack `1.4.6`, `1.5.2`, `1.6.1`, or `1.7.0`, matching the release line you run.","reach":"network","title":"BACnet Stack: missing client certificate check lets anyone join the mesh","impact":"medium","summary":"BACnet Stack's Linux WebSocket hub loads a CA certificate but never requires clients to present one, so it accepts TLS connections from clients with no certificate. A network-reachable host can join the BACnet/SC mesh without credentials.","audience":"developers","category":"package","nicknames":[],"who_cares":["bacnet","bacnet-sc","embedded","linux","building-automation"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"Unauthenticated hosts join the BACnet/SC mesh and gain network access","analyst_note":"product_name not listed; affected product is the BACnet Stack C library (ports/linux websocket hub).","how_to_check":"- Check the installed BACnet Stack version against the fixed versions listed below.\n- Look in `ports/linux/websocket-srv.c` for `LWS_SERVER_OPTION_REQUIRE_VALID_OPENSSL_CLIENT_CERT` in `bws_srv_start()`; if it is absent, the hub is affected.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["hub-not-used","patched-version"],"who_is_affected":"Systems built on the BACnet Stack Linux WebSocket hub (ports/linux) for BACnet/SC networks. The flaw is in the hub's TLS server setup, so any deployment running that hub on a reachable network is exposed; deployments that do not use the Linux websocket hub are not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000791,"input_tokens":4695,"output_tokens":644,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-102612':14A,17A '-2026':13A,16A '1.4.6':84C,146C '1.5.2':85C,147C '1.6.1':87C,148C '1.7.0':150C 'accept':47B,117C 'anyon':8A 'autom':24B 'bacnet':1A,18B,20B,28B,67C,71C 'bacnet-sc':19B 'bacnet/sc':63B,135C 'build':23B,93C 'building-autom':22B 'bws':88C 'c':76C 'ca':36B,100C 'cert':113C 'certif':5A,37B,54B,101C,124C 'check':6A 'client':4A,41B,51B,112C,121C 'connect':49B,119C 'context':97C 'credenti':66B,138C 'cve':12A,15A 'embed':25B,79C 'host':59B,131C 'hub':33B,116C 'issu':140C 'join':9A,61B,133C 'let':7A 'librari':77C 'libwebsocket':95C 'linux':26B,31B 'load':34B,102C 'lws':106C 'mesh':11A,64B,136C 'miss':3A 'network':57B,129C 'network-reach':56B,128C 'never':39B,104C 'one':44B 'open':72C 'openssl':111C 'option':108C 'packag':27B 'patch':143C 'ports/linux/websocket-srv.c':92C 'present':43B,122C 'prior':81C 'protocol':74C 'reachabl':58B,130C 'requir':40B,109C 'sc':21B 'server':96C,107C 'set':105C 'sourc':73C 'srv':89C 'stack':2A,29B,68C,75C 'start':90C 'system':80C 'tls':48B,118C 'valid':110C 'version':83C,145C 'websocket':32B 'without':65B,137C","nicknames":[],"mitigations":[],"who_affected":"Systems built on the BACnet Stack Linux WebSocket hub (ports/linux) for BACnet/SC networks. The flaw is in the hub's TLS server setup, so any deployment running that hub on a reachable network is exposed; deployments that do not use the Linux websocket hub are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["bacnet","bacnetsc","buildingautomation","embedded","high","linux","package"],"campaign_type":null,"search_a":"'-102612':14A,17A '-2026':13A,16A 'anyon':8A 'bacnet':1A 'certif':5A 'check':6A 'client':4A 'cve':12A,15A 'join':9A 'let':7A 'mesh':11A 'miss':3A 'stack':2A","search_b":"'accept':47B 'autom':24B 'bacnet':18B,20B,28B 'bacnet-sc':19B 'bacnet/sc':63B 'build':23B 'building-autom':22B 'ca':36B 'certif':37B,54B 'client':41B,51B 'connect':49B 'credenti':66B 'embed':25B 'host':59B 'hub':33B 'join':61B 'linux':26B,31B 'load':34B 'mesh':64B 'network':57B 'network-reach':56B 'never':39B 'one':44B 'packag':27B 'present':43B 'reachabl':58B 'requir':40B 'sc':21B 'stack':29B 'tls':48B 'websocket':32B 'without':65B","search_c":"'1.4.6':84C,146C '1.5.2':85C,147C '1.6.1':87C,148C '1.7.0':150C 'accept':117C 'bacnet':67C,71C 'bacnet/sc':135C 'build':93C 'bws':88C 'c':76C 'ca':100C 'cert':113C 'certif':101C,124C 'client':112C,121C 'connect':119C 'context':97C 'credenti':138C 'embed':79C 'host':131C 'hub':116C 'issu':140C 'join':133C 'librari':77C 'libwebsocket':95C 'load':102C 'lws':106C 'mesh':136C 'network':129C 'network-reach':128C 'never':104C 'open':72C 'openssl':111C 'option':108C 'patch':143C 'ports/linux/websocket-srv.c':92C 'present':122C 'prior':81C 'protocol':74C 'reachabl':130C 'requir':109C 'server':96C,107C 'set':105C 'sourc':73C 'srv':89C 'stack':68C,75C 'start':90C 'system':80C 'tls':118C 'valid':110C 'version':83C,145C 'without':137C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-04T10:38:42+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-102612","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102612","severity":null,"published_at":"2026-11-13T19:17:37+00:00","modified_at":"2026-11-13T19:17:37+00:00","first_seen_at":"2026-11-13T19:52:09+00:00","fetched_at":"2026-11-13T19:52:09+00:00","note":null}],"documents":[{"id":149127,"url":"https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-92q2-p4vr-fvmp","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-04T10:38:42+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}