A vulnerability exists in EnOcean SmartServer IoT version 4.60.009 and earlier, where remote attackers can send specially crafted LON IP-852 management messages that trigger an out‑of‑bounds read and produce a memory leak. This CWE‑125 issue allows the program to release sensitive contents from its memory, potentially exposing confidential data stored in the device. The flaw does not provide direct code execution, but the leaked information could be used for further attacks such as credential reuse or targeted exploitation.

The affected product is EnOcean Edge Inc’s SmartServer IoT platform. Versions 4.60.009 and any prior releases are vulnerable. EnOcean recommends upgrading to SmartServer 4.6 Update 2 (v4.60.023) or a newer release to mitigate the problem.

The CVSS score of 3.7 indicates a moderate risk, and the EPSS score of less than 1% shows a very low likelihood that this vulnerability will be actively exploited. The vulnerability is not listed in the CISA KEV catalog, further suggesting limited current exploitation. The attack would occur over the network—remote attackers could craft IP‑852 messages to trigger the memory leak, so network access to SmartServer devices is a prerequisite. The overall risk is moderate, but remediation is recommended to prevent potential data disclosure.