{"id":"CVE-2026-47711","kind":"vulnerability","aliases":["CVE-2026-47711"],"related":[],"title":"BACnet Stack: remote WriteProperty request crashes the demo server","description":"BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.4, 1.5.1, and 1.6.0, the current master demo server can be crashed remotely over BACnet/IP by sending a valid Confirmed WriteProperty request that updates loop-1's controlled-variable-reference to point to life-safety-zone-1 / accepted-modes. This issue has been patched in versions 1.4.4, 1.5.1, and 1.6.0.","summary":"BACnet Stack is an open source C library for BACnet building-automation devices. A valid Confirmed WriteProperty request sent over BACnet/IP can crash the master demo server.","severity":"high","cvss":8.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bacnet","building-automation","c","embedded","package"],"not_affected_if":["not-demo-server","patched-version"],"how_to_check":"- Check the BACnet Stack version in the project's source or package manifest; affected versions are before `1.4.4`, `1.5.1` and `1.6.0`.\n- Check whether the demo server build is deployed on any device reachable over BACnet/IP.","fix":"- Upgrade to `1.4.4`, `1.5.1` or `1.6.0` (the fixed version for each release line).","status":"open","published_at":"2026-11-12T20:18:41+00:00","first_seen_at":"2026-11-12T20:40:26+00:00","triaged_at":"2026-11-12T20:41:56+00:00","updated_at":"2026-11-12T20:41:56+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-12T20:41:56Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade to `1.4.4`, `1.5.1` or `1.6.0` (the fixed version for each release line).","reach":"network","title":"BACnet Stack: remote WriteProperty request crashes the demo server","impact":"medium","summary":"BACnet Stack is an open source C library for BACnet building-automation devices. A valid Confirmed WriteProperty request sent over BACnet/IP can crash the master demo server.","audience":"developers","category":"package","nicknames":[],"who_cares":["bacnet","embedded","c","building-automation"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"remote crash of the demo server over BACnet/IP","analyst_note":"","how_to_check":"- Check the BACnet Stack version in the project's source or package manifest; affected versions are before `1.4.4`, `1.5.1` and `1.6.0`.\n- Check whether the demo server build is deployed on any device reachable over BACnet/IP.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["patched-version","not-demo-server"],"who_is_affected":"Teams that build or ship the BACnet Stack C library, especially the master demo server, and that expose it over BACnet/IP. Systems using a patched version or not running the demo server are not affected as described.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00071,"input_tokens":4625,"output_tokens":495,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-1':93C '-2026':11A,14A '-47711':12A,15A '1':106C '1.4.4':68C,117C '1.5.1':69C,118C '1.6.0':71C,120C 'accept':108C 'accepted-mod':107C 'autom':19B,35B 'bacnet':1A,16B,23B,32B,51C,55C 'bacnet/ip':44B,82C 'build':18B,34B 'building-autom':17B,33B 'c':20B,29B,60C 'confirm':39B,87C 'control':96C 'controlled-variable-refer':95C 'crash':6A,46B,79C 'current':73C 'cve':10A,13A 'demo':8A,49B,75C 'devic':36B 'embed':21B,63C 'issu':111C 'librari':30B,61C 'life':103C 'life-safety-zon':102C 'loop':92C 'master':48B,74C 'mode':109C 'open':27B,56C 'packag':22B 'patch':114C 'point':100C 'prior':65C 'protocol':58C 'refer':98C 'remot':3A,80C 'request':5A,41B,89C 'safeti':104C 'send':84C 'sent':42B 'server':9A,50B,76C 'sourc':28B,57C 'stack':2A,24B,52C,59C 'system':64C 'updat':91C 'valid':38B,86C 'variabl':97C 'version':67C,116C 'writeproperti':4A,40B,88C 'zone':105C","nicknames":[],"mitigations":[],"who_affected":"Teams that build or ship the BACnet Stack C library, especially the master demo server, and that expose it over BACnet/IP. Systems using a patched version or not running the demo server are not affected as described.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["bacnet","buildingautomation","c","embedded","high","package"],"campaign_type":null,"search_a":"'-2026':11A,14A '-47711':12A,15A 'bacnet':1A 'crash':6A 'cve':10A,13A 'demo':8A 'remot':3A 'request':5A 'server':9A 'stack':2A 'writeproperti':4A","search_b":"'autom':19B,35B 'bacnet':16B,23B,32B 'bacnet/ip':44B 'build':18B,34B 'building-autom':17B,33B 'c':20B,29B 'confirm':39B 'crash':46B 'demo':49B 'devic':36B 'embed':21B 'librari':30B 'master':48B 'open':27B 'packag':22B 'request':41B 'sent':42B 'server':50B 'sourc':28B 'stack':24B 'valid':38B 'writeproperti':40B","search_c":"'-1':93C '1':106C '1.4.4':68C,117C '1.5.1':69C,118C '1.6.0':71C,120C 'accept':108C 'accepted-mod':107C 'bacnet':51C,55C 'bacnet/ip':82C 'c':60C 'confirm':87C 'control':96C 'controlled-variable-refer':95C 'crash':79C 'current':73C 'demo':75C 'embed':63C 'issu':111C 'librari':61C 'life':103C 'life-safety-zon':102C 'loop':92C 'master':74C 'mode':109C 'open':56C 'patch':114C 'point':100C 'prior':65C 'protocol':58C 'refer':98C 'remot':80C 'request':89C 'safeti':104C 'send':84C 'server':76C 'sourc':57C 'stack':52C,59C 'system':64C 'updat':91C 'valid':86C 'variabl':97C 'version':67C,116C 'writeproperti':88C 'zone':105C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-07-05T02:03:30+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-47711","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47711","severity":null,"published_at":"2026-11-12T20:18:41+00:00","modified_at":"2026-11-12T20:18:41+00:00","first_seen_at":"2026-11-12T20:40:26+00:00","fetched_at":"2026-11-12T20:40:26+00:00","note":null}],"documents":[{"id":138287,"url":"https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-vrpm-9gm2-x552","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-05T02:03:30+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}