CVE-2026-102612: BACnet Stack: BACnet/SC hub never requires a client cert, so any host joins the mesh unauthenticated
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.6, 1.5.2, and 1.6.1, bwssrvstart() in ports/linux/websocket-srv.c builds the libwebsockets server context with a CA certificate loaded but never sets LWSSERVEROPTIONREQUIREVALIDOPENSSLCLIENTCERT, so the hub accepts TLS connections from clients presenting no certificate at all. Any network-reachable host can join the BACnet/SC mesh without credentials. This issue has been patched in versions 1.4.6, 1.5.2, 1.6.1, and 1.7.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.7.0
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using the BACnet/SC hub implemented by bws_srv_start() in ports/linux/websocket-srv.c are exposed when running versions earlier than 1.4.6, 1.5.2, or 1.6.1. The issue is fixed in 1.4.6, 1.5.2, 1.6.1, and 1.7.0.
What does an attacker need to exploit this?
An attacker only needs network reachability to the BACnet/SC hub. No credentials or client certificate are required, because the hub accepts TLS clients that present no certificate.
Is a default hub configuration affected?
Yes. The affected server setup loads a CA certificate but does not enable the libwebsockets option that requires a valid OpenSSL client certificate, leaving client-certificate authentication unenforced.
What is the immediate mitigation if upgrading is not possible?
Restrict network access to the BACnet/SC hub so that untrusted hosts cannot reach it. The described issue permits any network-reachable host to join the mesh without credentials.