BACnet Stack: Remote Denial of Service (CVE-2026-47711)
The BACnet Stack C library contains a remote denial of service vulnerability where the master demo server can be crashed by sending a specific Confirmed WriteProperty request.
CVE search metadata
CVE search record: CVE-2026-47711. Severity: high. CVSS: 8.6. KEV: no. Product: BACnet Stack. Brief: BACnet Stack: Remote Denial of Service (CVE-2026-47711). Brief link: https://feed.craftedsignal.io/briefs/2026-11-bacnet-stack-dos-cve-2026-47711/
Triage facts
Revision 1- Applicability
- BACnet Stack
- Evidence
- Unknown
- Severity
- Medium
- Sources
- 1 public source
- Freshness
- Revision 1Nov 12, 20:53 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
The BACnet Stack C library contains a vulnerability (CVE-2026-47711) affecting the master demo server. A remote actor can cause the server to crash over BACnet/IP by sending a Confirmed WriteProperty request that updates 'loop-1's controlled-variable-reference' to 'life-safety-zone-1 / accepted-modes'.
Impact
Successful exploitation results in a remote denial of service of the BACnet master demo server instance.
Recommendation
Review the vendor documentation for patch availability and recommended updates.