{"affected":[{"product":"bacnet-stack","source":"CNA: GitHub_M","vendor":"bacnet-stack","versions":[{"status":"affected","version":"< 1.4.6"},{"status":"affected","version":">= 1.5.0, < 1.5.2"},{"status":"affected","version":">= 1.6.0, < 1.6.1"}]}],"cveId":"CVE-2026-102612","cwes":["CWE-295"],"description":"BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.6, 1.5.2, and 1.6.1, bws_srv_start() in ports/linux/websocket-srv.c builds the libwebsockets server context with a CA certificate loaded but never sets LWS_SERVER_OPTION_REQUIRE_VALID_OPENSSL_CLIENT_CERT, so the hub accepts TLS connections from clients presenting no certificate at all. Any network-reachable host can join the BACnet/SC mesh without credentials. This issue has been patched in versions 1.4.6, 1.5.2, 1.6.1, and 1.7.0.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":8.1,"severity":"high","source":"CNA: GitHub_M","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}],"modifiedAt":1794595401138,"publishedAt":1794595401138,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-92q2-p4vr-fvmp"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/bacnet-stack/bacnet-stack/pull/1436"}],"remediation":[],"revision":"84c8a217421e34d334536507b8181664ee63612afa9b07ca823251d40b667bfc","sources":[{"modifiedAt":1794595401138,"name":"CNA: GitHub_M","retrievedAt":1794596908796,"url":"https://www.cve.org/CVERecord?id=CVE-2026-102612"}],"ssvc":null,"status":"published","title":"BACnet Stack: BACnet/SC hub never requires a client cert, so any host joins the mesh unauthenticated","updatedAt":1794596908796}