Skip to content
OpenAdvisories
High · 8.1 CVE-2026-47257 EUVD-2026-124663

BACnet Stack: ReinitializeDevice ENDRESTORE can delete existing objects on an empty restore file and still return success

Published Nov 12, 2026 · Updated Nov 13, 2026 · Assigned by GitHub_M

Description

BACnet Stack is a BACnet open source protocol stack C library for embedded systems. In versions 1.5.0 and 1.6.0-rc1, there is a restore logic flaw in bacnet-stack that is reachable through the official, unmodified apps/server management path when BACNET_BACKUP_RESTORE is enabled. This issue has been patched in versions 1.5.1 and 1.6.0.

Affected products

VendorProductAffectedFixed
bacnet-stack bacnet-stack >= 1.5.0, < 1.5.1, >= 1.6.0-rc1, < 1.6.0 —

References