Skip to content
OpenAdvisories
High ICSA-26-050-01 2 CVEs

EnOcean SmartServer IoT

Published Feb 19, 2026 · Updated Feb 19, 2026

Vendor: EnOcean Edge Product: SmartServer IoT

Summary

Successful exploitation of these vulnerabilities could allow an attacker to remotely execute arbitrary code and bypass ASLR.

Vulnerabilities 2

  • High 8.1
    CVE-2026-20761

    EnOcean SmartServer IoT Command Injection

    A vulnerability exists in EnOcean SmartServer IoT version 4.60.009 and prior, which would allow remote attackers, in the LON IP-852 management messages, to send specially crafted IP-852 messages resulting in arbitrary OS command execution on the device.

    EnOcean Edge SmartServer IoT
  • Low 3.7
    CVE-2026-22885

    EnOcean SmartServer IoT Out-of-bounds Read

    A vulnerability exists in EnOcean SmartServer IoT version 4.60.009 and prior, which would allow remote attackers, in the LON IP-852 management messages, to send specially crafted IP-852 messages resulting in a memory leak from the program's memory.

    EnOcean Edge SmartServer IoT

Revision history

  1. #1

    Initial Publication

References