{"affected":[{"product":"bacnet-stack","source":"CNA: GitHub_M","vendor":"bacnet-stack","versions":[{"status":"affected","version":"< 1.4.6"},{"status":"affected","version":">= 1.5.0, < 1.5.2"},{"status":"affected","version":">= 1.6.0, < 1.6.1"}]}],"cveId":"CVE-2026-102537","cwes":["CWE-295"],"description":"BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.6, 1.5.2, and 1.6.1, bws_cli_connect() in ports/linux/websocket-cli.c loads the trusted CA cert into the libwebsockets context, then always sets LCCSCF_ALLOW_SELFSIGNED in the connection flags. So lws accepts any self-signed hub certificate, whether or not it chains to the loaded CA. A BACnet/SC node finishes the TLS handshake to a rogue hub that presents a self-signed cert. It then hands the attacker its identity (VMAC, UUID) and all later BACnet traffic. This issue has been patched in versions 1.4.6, 1.5.2, 1.6.1, and 1.7.0.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":7.7,"severity":"high","source":"CNA: GitHub_M","vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","version":"4.0"}],"modifiedAt":1794595310301,"publishedAt":1794595310301,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-jgm4-2wg9-jwfg"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/bacnet-stack/bacnet-stack/pull/1434"}],"remediation":[],"revision":"177301f5be696e67aaea77a465c3d18678bc5a68fc016053820edff23917c019","sources":[{"modifiedAt":1794595310301,"name":"CNA: GitHub_M","retrievedAt":1794596907689,"url":"https://www.cve.org/CVERecord?id=CVE-2026-102537"}],"ssvc":null,"status":"published","title":"bacnet-stack BACnet/SC node always accepts a self-signed hub cert, so an attacker can MITM it","updatedAt":1794596907689}