CVE-2025-41753: Path traversal in dynamically created BACnet File Objects
Published Oct 1, 2026
·Updated
The object name of a dynamically created BACnet File Object is interpreted as a file path without sufficient validation. Because relative paths are not limited to the intended directory, an unauthenticated remote attacker can traverse outside of it and read or overwrite arbitrary files on the device, which may lead to full system compromise.
Event History
Oct 1, 2026
CVE Published
via MITRE·06:42 AM
Data Sourced
via MITRE·06:42 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·07:16 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Does exploitation require authentication or user interaction?
No. The vulnerability is exploitable by an unauthenticated remote attacker and requires no user interaction.
2
What capabilities could an attacker gain?
An attacker may read or overwrite arbitrary files outside the intended directory. This can lead to full system compromise.
3
Which systems are exposed to this issue?
Systems that dynamically create BACnet File Objects and interpret their object names as file paths without sufficiently restricting relative paths are exposed.