CVE-2026-102537
Received Received - Intake

BACnet/SC TLS Certificate Validation Bypass

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: GitHub, Inc.

Description
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.6, 1.5.2, and 1.6.1, bws_cli_connect() in ports/linux/websocket-cli.c loads the trusted CA cert into the libwebsockets context, then always sets LCCSCF_ALLOW_SELFSIGNED in the connection flags. So lws accepts any self-signed hub certificate, whether or not it chains to the loaded CA. A BACnet/SC node finishes the TLS handshake to a rogue hub that presents a self-signed cert. It then hands the attacker its identity (VMAC, UUID) and all later BACnet traffic. This issue has been patched in versions 1.4.6, 1.5.2, 1.6.1, and 1.7.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-102537
EUVD
EUVD-2026-125695

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-295 The product does not validate, or incorrectly validates, a certificate.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the BACnet Stack library's BACnet/SC implementation. It allows attackers to perform man-in-the-middle attacks by exploiting improper TLS certificate validation. The function bws_cli_connect() in ports/linux/websocket-cli.c loads a trusted CA certificate but then sets flags that bypass proper validation, accepting any self-signed hub certificate. This lets attackers intercept or impersonate the hub endpoint and steal BACnet/SC node identity and traffic.

Detection Guidance

To detect this vulnerability, check if your BACnet/SC node is running a vulnerable version of bacnet-stack (up to 1.5.0). Inspect the websocket-cli.c file for the presence of LCCSCF_ALLOW_SELFSIGNED and LCCSCF_SKIP_SERVER_CERT_HOSTNAME_CHECK flags in bws_cli_connect(). Monitor network traffic for unexpected TLS handshakes or certificate errors.

Impact Analysis

If you use BACnet Stack versions before 1.4.6, 1.5.2, 1.6.1, or 1.7.0, an attacker in a network position to intercept traffic could impersonate a BACnet hub. They would receive your node's identity (VMAC, UUID) and all subsequent BACnet traffic. This requires an on-path attack or hub impersonation but does not need complex exploits.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive BACnet traffic, potentially exposing personal or operational data. For GDPR, this may violate data confidentiality requirements. For HIPAA, it could compromise protected health information if BACnet systems are used in healthcare environments. Compliance may be impacted due to insufficient transport-layer security.

Mitigation Strategies

Upgrade to patched versions (1.4.6, 1.5.2, 1.6.1, or 1.7.0) immediately. Disable support for self-signed certificates by default and avoid using the BACNET_SC_SELFSIGNED_ENABLED environment variable unless explicitly required. Ensure strict TLS validation is enforced in your BACnet/SC configuration.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-102537. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...