BACnet Stack open-source C library (bacnet-stack) embedded in third-party controllers and gateways: A run

Impact

A run of out-of-bounds reads and length underflows in the decoders for WritePropertyMultiple, ReadPropertyMultiple, WriteProperty and NPDU handling, all reachable by an unauthenticated attacker sending a truncated or malformed request. The reason this matters more than the individual CVSS scores suggest is supply chain: bacnet-stack is the reference C implementation that a long tail of controller, gateway and sensor vendors embed in their firmware without ever telling the customer. Your CRAH controller, your BACnet router, your rear-door heat exchanger's BACnet interface and your environmental gateway may all be running the same library, and none of them appear in a search for 'bacnet-stack'. One crafted packet can therefore crash a heterogeneous set of devices simultaneously - a fleet-wide loss of thermal control in a hall where 40-140 kW racks have minutes of margin. Earlier issues in the same library reached memory corruption rather than just reads, so treat the class as potentially more than DoS on older embedded builds.

Who can reach it

Unauthenticated BACnet/IP on the facility network. No credentials, no interaction, and in several of these cases the trigger is a single truncated request. Broadcast-reachable services widen this further. The practical problem is that you cannot enumerate affected devices from the outside - you need each vendor to disclose whether they embed the library and at what version, and most will not answer quickly.

What to do

You cannot patch this yourself in the general case. The library fix is upstream (bacnet-stack 1.4.3 / 1.5.0 and later), but the code is compiled into vendor firmware, so remediation means each device vendor rebuilding and shipping firmware, then a per-device flash by the controls contractor. Expect that most embedded devices in your hall will never get a fixed build. That makes segmentation the actual answer: BACnet on an isolated VLAN, no untrusted hosts on it, no BBMD bridging to anything else. In parallel, use this as a procurement lever - make an SBOM for the BACnet stack a requirement in new controller purchases, because right now operators have no way to answer 'am I affected' and that is the real finding.

References