BACnet Stack’s file‑writing functions fail to validate user‑supplied file paths, permitting attackers to write files to any filesystem location. This flaw is a classic example of an uncontrolled path traversal (CWE‑22) that can compromise confidentiality, integrity, or availability if critical files are altered or malicious payloads are deployed. The vulnerability is present in the libraries used by apps/readfile/main.c and ports/posix/bacfile‑posix.c, allowing write operations without directory restriction.

The affected product is the BACnet Stack library from the bacnet-stack project. Versions 1.5.0 rc1 and rc2 are vulnerable; the issue is resolved in 1.5.0 rc3 and later releases. The flaw is relevant to embedded systems that use the BACnet protocol stack for building automation, HVAC, and related industrial control settings.

The CVSS score of 7.5 indicates high severity, while the EPSS score of less than 1% reflects a low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog, but the potential impact of uncontrolled file writes is significant. The likely attack vector is an adversary that can invoke the BACnet stack’s file writing interface—either remotely or locally—together with any utility that specifies file paths. Successful exploitation would allow an attacker to create, modify, or delete files anywhere on the device’s filesystem.