CVE-2026-47257: BACnet Stack: ReinitializeDevice ENDRESTORE can delete existing objects on an empty restore file and still return success

Published Nov 12, 2026

Updated

BACnet Stack is a BACnet open source protocol stack C library for embedded systems. In versions 1.5.0 and 1.6.0-rc1, there is a restore logic flaw in bacnet-stack that is reachable through the official, unmodified apps/server management path when BACNETBACKUPRESTORE is enabled. This issue has been patched in versions 1.5.1 and 1.6.0.

Affected Software

1 affected component

BACnet Stack BACnet Stack=1.5.0, =1.6.0-rc1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade BACnet Stack to a version that resolves this vulnerability.
Fixed in 1.5.1
Upgrade
Upgrade BACnet Stack to a version that resolves this vulnerability.
Fixed in 1.6.0

Event History

Nov 12, 2026

CVE Published

via MITRE·08:01 PM

Data Sourced

via OSV·08:01 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·08:18 PM

DescriptionSeverityWeakness

Nov 13, 2026

Exploit Published

via CISA·12:29 AM

Frequently Asked Questions

Which deployments are exposed?

Deployments using BACnet Stack versions 1.5.0 or 1.6.0-rc1 are affected when BACNET_BACKUP_RESTORE is enabled. The flaw is reachable through the official, unmodified apps/server management path.

What access does an attacker need to exploit this issue?

The severity vector indicates network access, low attack complexity, and low privileges are required. No user interaction is required.

What is the impact of a successful exploit?

An empty restore file can cause existing objects to be deleted while the ReinitializeDevice ENDRESTORE operation still reports success. The stated impact is high integrity and availability impact, with no confidentiality impact.

Which versions contain the fix?

The issue is patched in BACnet Stack versions 1.5.1 and 1.6.0.