CVE-2026-47257 · Package
NO FIX YET · SEE WHAT TO DO
BACnet Stack is an open source BACnet protocol C library used in embedded building-automation devices. In versions 1.5.0 and 1.6.0-rc1, a restore logic flaw is reachable through the official apps/server management path when BACNET_BACKUP_RESTORE is enabled, and the sources do not state the attacker outcome beyond that.
first public Jul 5, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Systems built on BACnet Stack 1.5.0 or 1.6.0-rc1 with BACNET_BACKUP_RESTORE enabled, where the apps/server management path is reachable. Builds with the backup restore feature disabled, or other versions, are not covered by the sources.
Not affected if default-config, other-versions
Who cares bacnet-stack, building-automation, embedded
1.5.0 and 1.6.0-rc1.BACNET_BACKUP_RESTORE to enabled.1.5.1 or 1.6.0 (the sources state these versions patch the issue).BACnet Stack is a BACnet open source protocol stack C library for embedded systems. In versions 1.5.0 and 1.6.0-rc1, there is a restore logic flaw in bacnet-stack that is reachable through the official, unmodified apps/server management path when BACNET_BACKUP_RESTORE is enabled. This issue has been patched in versions 1.5.1 and 1.6.0.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.