A stack based buffer overflow exists in the bac-deviceobject method. The flaw can be triggered by an attacker who has user‑level access to the device, enabling the overflow of the stack and execution of arbitrary code. Successful exploitation grants the attacker full root‑level control over the affected system.

All MBS devices listed as affected by the CNA advisories, including Double‑A Profibus, Double‑A x‑link, Double‑X CAN, Double‑X DALI, Double‑X KNX, Double‑X LON, Double‑X M‑Bus, Double‑X PROFINET, Double‑X x‑link, Single‑A, Single‑X, and the various Triple‑X combinations of KNX, DALI, LON, and PROFINET. No specific firmware version details are provided, so any firmware running the vulnerable method is potentially at risk until a patch is applied.

The CVSS score of 8.7 marks this vulnerability as high impact. EPSS data is not available and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is remote; an attacker with user privileges can deliver malicious input over the network to invoke the buffer overflow. Because the flaw allows code execution, the risk of exploitation is significant and should be treated with priority.