CVE-2026-21878: Arbitrary File Write in BACnet Stack

The primary impact of CVE-2026-21878 is the ability for an attacker to write arbitrary files to the system. This can be exploited to overwrite critical system files, inject malicious code, or gain persistent access. Successful exploitation could lead to complete system compromise, data exfiltration, and denial of service. The vulnerability resides in the file writing functionality within apps/readfile/main.c and ports/posix/bacfile-posix.c, highlighting the importance of secure file handling practices in embedded systems. While no direct precedent is immediately obvious, the potential for arbitrary file writes shares similarities with other privilege escalation vulnerabilities where attackers leverage file system access to gain higher privileges.

1. Reserved2026-01-05
2. Published2026-02-13
3. EPSS updated2026-03-23

The primary mitigation for CVE-2026-21878 is to upgrade to BACnet Stack version 1.5.0.rc3 or later, which includes the necessary file path validation fix. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) or proxy to filter out malicious file path requests. Additionally, restrict file system permissions to the minimum necessary for the BACnet Stack application. Monitor system logs for unusual file creation or modification activity, particularly in sensitive directories. There are no specific Sigma or YARA rules readily available for this vulnerability, but creating custom rules based on file path patterns and unusual file creation events is recommended.