What’s Vulnerable › Vulnerabilities

CVE-2023-51773

• Severity: critical (CVSS 9.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-02-29 · updated 2026-06-17
• Weakness: CWE-126

Description

BACnet Stack before 1.3.2 has a decode function APDU buffer over-read in bacapp_decode_application_data in bacapp.c.

Affected products

• bacnet-stack: before 1.3.2 — fixed in 1.3.2

How to fix

Upgrade to a fixed version: bacnet-stack 1.3.2. Check the vendor advisory for mitigations.

References

• https://github.com/bacnet-stack/bacnet-stack/blob/master/CHANGELOG.md
• https://github.com/bacnet-stack/bacnet-stack/compare/bacnet-stack-1.3.1...bacnet-stack-1.3.2
• https://github.com/bacnet-stack/bacnet-stack/pull/546
• https://github.com/bacnet-stack/bacnet-stack/pull/546/commits/c465412a076ca6c9ddf649612f2b4e1874d8dcb8
• https://sourceforge.net/p/bacnet/bugs/85/
• https://github.com/bacnet-stack/bacnet-stack/blob/master/CHANGELOG.md
• https://github.com/bacnet-stack/bacnet-stack/compare/bacnet-stack-1.3.1...bacnet-stack-1.3.2
• https://github.com/bacnet-stack/bacnet-stack/pull/546
• https://github.com/bacnet-stack/bacnet-stack/pull/546/commits/c465412a076ca6c9ddf649612f2b4e1874d8dcb8
• https://sourceforge.net/p/bacnet/bugs/85/

Get alerted when CVE-2023-51773 or the next vulnerability affects your stack