Loading story…
Two high-severity vulnerabilities in the open-source BACnet Stack C library allow unauthenticated remote attackers to trigger out-of-bounds reads in BACnet/IP property decoding logic on embedded devices. CVE-2026-41503 affects the ReadPropertyMultiple service, where rpm_decode_object_property() uses the deprecated decode_tag_number_and_value() parser without a buffer length, enabling a crafted truncated property list with a 1-byte payload and extended tag marker 0xF9 to read 1 byte past the end of the buffer. CVE-2026-41475 affects the WritePropertyMultiple service, where wpm_decode_object_property() invokes the same deprecated parser without proper bounds checking, allowing a truncated request to read 1 to 7 bytes out of bounds.
The flaws affect BACnet Stack versions prior to 1.4.3 and are classified as CWE-125. Reported impact includes denial of service through crashes on embedded BACnet devices, with the WritePropertyMultiple issue also carrying potential information disclosure risk. The vulnerable code paths are reachable over the network with no authentication or user interaction, and the ReadPropertyMultiple confirmed service handler is enabled by default in the reference server. Both issues were addressed in version 1.4.3, with a GitHub security advisory published alongside the disclosures.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
A GitHub security advisory was published for CVE-2026-41475, documenting the out-of-bounds read in the WritePropertyMultiple decoder and its remediation in BACnet Stack 1.4.3.
A new CVE, CVE-2026-41502, was published for an off-by-one out-of-bounds read in BACnet Stack's ReadPropertyMultiple object ID decoder. The flaw affects versions prior to 1.4.3, can be triggered remotely with a crafted truncated request, and was remediated in version 1.4.3.
Two CVEs were published for BACnet Stack: CVE-2026-41475 in the WritePropertyMultiple decoder and CVE-2026-41503 in the ReadPropertyMultiple decoder. Both issues stem from use of the deprecated decode_tag_number_and_value() parser without proper buffer-length handling and primarily impact embedded BACnet devices.
BACnet Stack version 1.4.3 fixed two out-of-bounds read flaws in the ReadPropertyMultiple and WritePropertyMultiple service decoders. The bugs affected versions prior to 1.4.3 and could be triggered remotely with crafted truncated BACnet/IP requests, causing crashes and possible limited information disclosure.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
TWCERT/CC disclosed three critical vulnerabilities in **BorG Technology Corporation's Borg SPM 2007** that can be exploited remotely without authentication. The issues are tracked as **`CVE-2026-6885`**, an arbitrary file upload flaw mapped to **`CWE-434`** that allows attackers to upload and execute web shell backdoors; **`CVE-2026-6886`**, an authentication bypass mapped to **`CWE-1390`** that lets attackers log in as any user; and **`CVE-2026-6887`**, a SQL injection flaw mapped to **`CWE-89`** that enables arbitrary SQL commands against the backend database. All three vulnerabilities carry high-severity impact ratings with **CVSS v3.1** vectors of **`AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`**, indicating low-complexity network exploitation with no privileges or user interaction required. Successful attacks could lead to arbitrary code execution, unauthorized account access, and the reading, modification, or deletion of database contents, creating a path to full compromise of exposed Borg SPM 2007 deployments. The product is described as having ended sales in 2008, but systems still in operation remain at risk.
Jun 29, 2026
D-Link NAS and recorder products were found to contain multiple **remote stack-based buffer overflow** vulnerabilities affecting `/cgi-bin/app_mgr.cgi`, `/cgi-bin/webdav_mgr.cgi`, and `/cgi-bin/account_mgr.cgi`. The issues were assigned `CVE-2026-5211`, `CVE-2026-5212`, and `CVE-2026-5213` and impact a broad set of devices, including **DNS-120**, **DNS-320 series**, **DNS-340L**, **DNS-345**, **DNS-726-4**, **DNS-1100-4**, **DNS-1200-05**, and **DNS-1550-04**. The flaws are triggered by crafted input to specific parameters: `f_dir` in the `UPnP_AV_Server_Path_Del` function, `f_file` in the `Webdav_Upload_File` function, and `read_list` in the `cgi_adduser_to_session` function. Because the vulnerabilities can be exploited remotely and public exploit details have been disclosed, exposed devices face an elevated risk of compromise and potential attacker weaponization in real-world attacks.
Jun 29, 2026
Cisco disclosed **CVE-2026-20200**, a high-severity argument injection flaw in the web-based management interface of Cisco Integrated Management Controller (**IMC**) that allows an authenticated low-privilege attacker to execute arbitrary commands as `root`. The vulnerability, scored **CVSS 8.8**, affects multiple Cisco Unified Computing System standalone releases in the 4.3 and 6.0 branches, and Cisco urged customers to apply updates, validate management-interface inputs, and limit privileges for authenticated users. At the same time, research presented by runZero and reported from Black Hat 2026 warned that baseboard management controllers (**BMCs**) across major vendors remain broadly exposed and vulnerable to takeover. runZero said it found multiple flaws affecting platforms including **OpenBMC, Supermicro IPMI, HPE iLO, Dell iDRAC, AMI MegaRAC, Raritan, H3C HDM, and Fujitsu BMC**, while scans cited by Ars Technica identified more than **86,000** Internet-exposed BMCs and found over **54%** with at least one critical weakness. Researchers said exploitation can enable persistent server backdoors, lateral movement, and segmentation bypass, and recommended isolating BMC interfaces from the public Internet, monitoring vendor advisories, patching promptly, and disabling legacy management features such as IPMI and KCS where possible.
Aug 6, 2026