CVE-2025-13926: Contemporary Controls BASC 20T CSRF Flaw

CVE-2025-13926 Overview

CVE-2025-13926 is a critical vulnerability affecting the Contemporary Controls BASC 20T industrial control system device. An attacker could use data obtained by sniffing network traffic to forge packets in order to make arbitrary requests to the affected device. This vulnerability is classified under CWE-807 (Reliance on Untrusted Inputs in a Security Decision), indicating that the device improperly trusts network data without adequate validation or authentication.

Critical Impact

This vulnerability allows remote, unauthenticated attackers to intercept network communications and forge malicious packets, potentially enabling full control over industrial building automation systems without requiring any user interaction.

Affected Products

• Contemporary Controls BASC 20T

Discovery Timeline

• 2026-04-09 - CVE CVE-2025-13926 published to NVD
• 2026-04-09 - Last updated in NVD database

Technical Details for CVE-2025-13926

Vulnerability Analysis

This vulnerability stems from the device's reliance on untrusted inputs when making security decisions (CWE-807). The Contemporary Controls BASC 20T building automation system controller fails to properly authenticate or validate network communications, allowing attackers who can observe network traffic to capture and replay or forge packets.

The network-based attack vector means that an adversary positioned on the same network segment as the vulnerable device can passively collect network traffic to understand the communication protocol. Once sufficient data is gathered, the attacker can craft malicious packets that the device will accept as legitimate requests, potentially enabling unauthorized control over building automation functions.

This type of vulnerability is particularly concerning in industrial control system (ICS) and operational technology (OT) environments where building automation controllers manage critical infrastructure such as HVAC systems, access controls, and energy management systems.

Root Cause

The root cause of CVE-2025-13926 is the device's reliance on untrusted inputs in security decisions. The BASC 20T controller does not implement adequate cryptographic protections or authentication mechanisms for network communications, allowing attackers to observe valid traffic patterns and subsequently forge packets that the device treats as legitimate commands.

Attack Vector

The attack proceeds through a network-based vector requiring no authentication or user interaction:

1. Network Positioning: The attacker gains access to the network segment where the BASC 20T device operates
2. Traffic Sniffing: Using passive network monitoring tools, the attacker captures legitimate communication packets between the device and its management systems
3. Protocol Analysis: The captured traffic is analyzed to understand the command structure and communication patterns
4. Packet Forgery: The attacker crafts malicious packets mimicking legitimate requests, potentially including unauthorized commands
5. Arbitrary Request Execution: Forged packets are sent to the device, which processes them as valid requests due to insufficient validation

This attack methodology can be executed entirely from the network without requiring physical access to the device or valid credentials.

Detection Methods for CVE-2025-13926

Indicators of Compromise

• Unusual network traffic patterns or unexpected packet sources communicating with BASC 20T devices
• Anomalous commands or configuration changes on building automation controllers
• Unexplained changes to HVAC, lighting, or access control settings
• Network capture evidence showing replay attacks or malformed protocol communications

Detection Strategies

• Implement network monitoring to detect unauthorized traffic to and from BASC 20T devices
• Deploy ICS/OT-specific intrusion detection systems capable of analyzing BACnet and other building automation protocols
• Monitor for signs of passive reconnaissance such as unusual ARP requests or promiscuous mode network adapters
• Establish baseline network behavior for building automation systems and alert on deviations

Monitoring Recommendations

• Segment BASC 20T devices on isolated network VLANs with strict access controls
• Enable logging on network infrastructure devices to track all communications with vulnerable controllers
• Implement network traffic analysis for building automation protocol anomalies
• Conduct regular security assessments of OT/ICS network segments

How to Mitigate CVE-2025-13926

Immediate Actions Required

• Contact Contemporary Controls technical support for guidance on mitigation options (see Contact Technical Support)
• Isolate affected BASC 20T devices on dedicated network segments with strict firewall rules
• Implement network monitoring to detect and alert on suspicious traffic patterns
• Restrict network access to only authorized management stations and users

Patch Information

Organizations should consult the CISA ICS Advisory ICSA-26-099-01 for the latest vendor guidance and patch availability. Additional technical details are available in the GitHub CSAF advisory file. Contact Contemporary Controls directly for firmware updates and remediation guidance.

Workarounds

• Implement network segmentation to isolate BASC 20T devices from general network traffic and potential attacker observation points
• Deploy encrypted VPN tunnels for remote management of building automation systems
• Use application-layer firewalls or protocol-aware gateways to filter unauthorized commands
• Disable unnecessary network services and ports on the device where possible
• Implement physical security controls to prevent unauthorized network access to OT segments

# Network segmentation example for isolating ICS/OT devices
# Configure VLAN isolation for building automation controllers
# Example firewall rules to restrict BASC 20T access

# Allow only authorized management stations
iptables -A FORWARD -s 192.168.100.0/24 -d 192.168.200.10 -j ACCEPT
iptables -A FORWARD -d 192.168.200.10 -j DROP

# Log all traffic to the device for monitoring
iptables -A FORWARD -d 192.168.200.10 -j LOG --log-prefix "BASC20T-ACCESS: "