CVE-2026-102612
Received Received - Intake

BACnet/SC Mesh Authentication Bypass in BACnet Stack

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: GitHub, Inc.

Description
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.6, 1.5.2, and 1.6.1, bws_srv_start() in ports/linux/websocket-srv.c builds the libwebsockets server context with a CA certificate loaded but never sets LWS_SERVER_OPTION_REQUIRE_VALID_OPENSSL_CLIENT_CERT, so the hub accepts TLS connections from clients presenting no certificate at all. Any network-reachable host can join the BACnet/SC mesh without credentials. This issue has been patched in versions 1.4.6, 1.5.2, 1.6.1, and 1.7.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-102612
EUVD
EUVD-2026-125697

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-295 The product does not validate, or incorrectly validates, a certificate.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the BACnet Stack library, specifically in the BACnet/SC websocket server implementation. The function bws_srv_start() fails to set the LWS_SERVER_OPTION_REQUIRE_VALID_OPENSSL_CLIENT_CERT option, allowing TLS connections without valid client certificates. This means any network-reachable host can join the BACnet/SC mesh without credentials, bypassing mutual TLS authentication required by the ASHRAE 135 Annex AB specification.

Detection Guidance

To detect this vulnerability, check if your BACnet/SC hub accepts TLS connections without client certificates. Use network scanning tools like nmap to verify if port 50050 (wss://) allows unauthenticated connections. Inspect the websocket server configuration in ports/linux/websocket-srv.c for the absence of LWS_SERVER_OPTION_REQUIRE_VALID_OPENSSL_CLIENT_CERT.

Impact Analysis

An attacker with network access to port 50050 can exploit this to join the BACnet/SC mesh as a trusted node without authentication. They could potentially send unauthorized commands or inject malicious traffic across the mesh by leveraging the hub's role in forwarding messages between peers.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive building automation systems, potentially violating data confidentiality and integrity requirements under standards like GDPR and HIPAA. Unauthorized access may expose personal or health-related data transmitted over the BACnet/SC mesh.

Mitigation Strategies

Upgrade to BACnet Stack versions 1.4.6, 1.5.2, 1.6.1, or 1.7.0 or later. Ensure the LWS_SERVER_OPTION_REQUIRE_VALID_OPENSSL_CLIENT_CERT option is enabled in the websocket server configuration. Verify that client certificates are required for TLS handshakes on port 50050.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-102612. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...