CVE-2026-21878
📋 TL;DR
This vulnerability in BACnet Stack allows attackers to write files to arbitrary directories due to lack of path validation in file writing functionality. It affects embedded systems using BACnet Stack library versions prior to 1.5.0.rc3. The vulnerability could lead to arbitrary file writes that may enable further system compromise.
💻 Affected Systems
- BACnet Stack library
📦 What is this software?
Bacnet Stack by Bacnetstack
Bacnet Stack by Bacnetstack
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through arbitrary file writes leading to remote code execution, system file corruption, or persistent backdoor installation.
Likely Case
File system manipulation allowing data corruption, denial of service, or privilege escalation through overwriting critical files.
If Mitigated
Limited impact with proper file system permissions and network segmentation preventing unauthorized access to BACnet services.
🎯 Exploit Status
Path traversal exploitation is well-understood and requires minimal technical skill once the vulnerable endpoint is identified.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.5.0.rc3
Vendor Advisory: https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-p8rx-c26w-545j
Restart Required: Yes
Instructions:
1. Update BACnet Stack library to version 1.5.0.rc3 or later. 2. Recompile any applications using the library. 3. Restart affected services or devices.
🔧 Temporary Workarounds
File System Permissions Restriction
linuxRestrict write permissions for the BACnet service account to only necessary directories
chmod -R 755 /var/lib/bacnet
chown -R bacnet:bacnet /var/lib/bacnet
Network Segmentation
allIsolate BACnet devices on separate VLANs with strict firewall rules
🧯 If You Can't Patch
- Implement strict network access controls to limit BACnet traffic to authorized sources only
- Deploy file integrity monitoring on critical system directories to detect unauthorized file writes
🔍 How to Verify
Check if Vulnerable:
Check BACnet Stack library version and verify if using functions from affected files (apps/readfile/main.c, ports/posix/bacfile-posix.c)Check Version:
grep -r "BACNET_STACK_VERSION" /usr/include/bacnet/ || check library documentationVerify Fix Applied:
Verify library version is 1.5.0.rc3 or later and examine commit c5dc00a77b4bc2550befa67a930b333e299c18f3 for path validation implementation📡 Detection & Monitoring
Log Indicators:
- Unusual file write operations by BACnet processes
- Path traversal patterns in BACnet service logs
- Permission denied errors for unexpected file paths
Network Indicators:
- BACnet protocol traffic to unexpected ports or from unauthorized sources
- Unusual file transfer patterns over BACnet
SIEM Query:
source="bacnet.log" AND ("..\" OR "/../" OR "path traversal")