VYPR
← All advisories
High severity7.5NVD Advisory· Published Feb 13, 2026· Updated Jun 17, 2026

CVE-2026-21878

CVE-2026-21878

Description

BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to 1.5.0.rc3, a vulnerability has been discovered in BACnet Stack's file writing functionality where there is no validation of user-provided file paths, allowing attackers to write files to arbitrary directories. This affects apps/readfile/main.c and ports/posix/bacfile-posix.c. This vulnerability is fixed in 1.5.0.rc3.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

4
  • Bacnetstack/Bacnet Stack4 versions
    cpe:2.3:a:bacnetstack:bacnet_stack:1.5.0:rc1:*:*:*:*:*:*+ 3 more
    • cpe:2.3:a:bacnetstack:bacnet_stack:1.5.0:rc1:*:*:*:*:*:*
    • cpe:2.3:a:bacnetstack:bacnet_stack:1.5.0:rc2:*:*:*:*:*:*
    • (no CPE)range: <1.5.0.rc3
    • (no CPE)range: < 1.5.0.rc3

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.