CVE-2020-36872
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-11-26

Last updated on: 2025-11-26

Assigner: VulnCheck

Description
BACnet Test Server versions up to and including 1.01 contains a remote denial of service vulnerability in its BACnet/IP BVLC packet handling. The server fails to properly validate the BVLC Length field in incoming UDP BVLC frames on the default BACnet port (47808/udp). A remote unauthenticated attacker can send a malformed BVLC Length value to trigger an access violation and crash the application, resulting in a denial of service.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-11-26
Last Modified
2025-11-26
Generated
2026-06-16
AI Q&A
2025-11-27
EPSS Evaluated
2026-06-15
NVD
CVE-2020-36872
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
bacnet test_server 1.01
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists in BACnet Test Server versions up to 1.01, where the server improperly validates the BVLC Length field in incoming BACnet/IP UDP packets. A remote attacker can send a malformed BVLC Length value, causing the server to crash due to an access violation, resulting in a denial of service.

Impact Analysis

The vulnerability can cause the BACnet Test Server to crash remotely without authentication, leading to a denial of service. This disrupts the availability of the server and any services relying on it, potentially impacting operational continuity.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2020-36872. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart