CVE-2025-41753: BACnet File Object Path Traversal Flaw

CVE-2025-41753 Overview

CVE-2025-41753 is a path traversal vulnerability [CWE-22] affecting devices that implement dynamically created BACnet File Objects. The object name supplied by a client is interpreted as a file path without sufficient validation. An unauthenticated remote attacker can supply relative path sequences to escape the intended directory. This allows arbitrary file read and overwrite on the affected device, which may lead to full system compromise. The issue is tracked in CERT VDE Advisory VDE-2025-102.

Critical Impact
Unauthenticated remote attackers can read or overwrite arbitrary files over the network via BACnet, enabling full device compromise.

Affected Products

Devices implementing dynamically created BACnet File Objects as described in VDE-2025-102
Vendor and product details: refer to the CERT VDE advisory for the authoritative affected-product list
Specific CPE identifiers are not published in the NVD entry at this time

Discovery Timeline

2026-10-01 - CVE CVE-2025-41753 published to NVD
2026-10-01 - Last updated in NVD database

Technical Details for CVE-2025-41753

Vulnerability Analysis

The BACnet protocol permits clients to create dynamic File Objects on a device. Affected implementations use the client-supplied Object_Name property directly as the on-disk file path. No canonicalization or directory confinement is applied before file operations execute.

Because the input is trusted, an attacker can submit relative path components such as ../ to traverse outside the intended storage directory. Subsequent BACnet File read or write services then act on the attacker-chosen path with the privileges of the BACnet service process.

The practical impact depends on the underlying service account. On embedded controllers that run BACnet with elevated privileges, an attacker can overwrite configuration files, firmware images, scripts loaded at boot, or credential stores. Reading arbitrary files exposes device secrets and operational data that supports further attacks on the control network.

Root Cause

The root cause is missing input validation on the BACnet Object_Name property for dynamically created File Objects. The implementation treats a protocol-level identifier as a file path without sanitizing path separators, resolving symbolic links, or enforcing a chroot-style base directory.

Attack Vector

Exploitation requires only network reachability to the BACnet service, typically UDP port 47808. No authentication or user interaction is required. An attacker on the operational technology (OT) network, or on an exposed IT segment that routes to the device, issues a CreateObject request for a File Object whose name contains traversal sequences. Follow-on AtomicReadFile or AtomicWriteFile requests then target arbitrary paths such as /etc/passwd or firmware partitions.

No public proof-of-concept is referenced in the advisory. Technical specifics are described in the CERT VDE Advisory VDE-2025-102.

Detection Methods for CVE-2025-41753

Indicators of Compromise

BACnet CreateObject requests whose Object_Name property contains ../, ..\, absolute paths, or null bytes
Unexpected AtomicWriteFile or AtomicReadFile operations targeting system directories outside the configured BACnet storage path
New or modified files on the device in paths that the BACnet service should not touch, including configuration, startup scripts, or firmware regions
Outbound anomalies from the controller following BACnet activity, suggesting post-exploitation staging

Detection Strategies

Inspect BACnet/IP traffic on UDP 47808 with an OT-aware intrusion detection system and alert on File Object names containing traversal metacharacters
Baseline legitimate BACnet file operations per device and flag deviations in object counts, names, or source addresses
Correlate BACnet protocol events with device file-system change events where host-based logging is available on the controller or gateway

Monitoring Recommendations

Capture full BACnet session metadata at the OT/IT boundary for retrospective hunting
Monitor for BACnet traffic originating from engineering workstations or hosts that have no operational reason to issue CreateObject requests
Track device firmware and configuration file hashes and alert on unexpected changes

How to Mitigate CVE-2025-41753

Immediate Actions Required

Identify all BACnet-capable devices in the environment and determine which implement dynamically created File Objects
Restrict BACnet/IP (UDP 47808) exposure to known engineering hosts using firewall or BACnet Broadcast Management Device (BBMD) policy
Remove any direct internet exposure of BACnet services and verify segmentation between IT and OT networks
Apply vendor firmware updates referenced in CERT VDE Advisory VDE-2025-102 as soon as they are available for your platform

Patch Information

Patch availability and fixed firmware versions are coordinated through CERT VDE. Consult the CERT VDE Advisory VDE-2025-102 for the current list of fixed releases and vendor-specific guidance. Apply updates during planned maintenance windows following OT change-control procedures.

Workarounds

Place affected controllers behind a BACnet-aware firewall that drops CreateObject requests with traversal sequences in the Object_Name property
Disable dynamic File Object creation on the device if the vendor exposes a configuration option
Enforce allowlists so that only designated engineering workstations can issue BACnet object-management services
Monitor for exploitation attempts with OT network detection until patches can be deployed

bash

# Example firewall policy restricting BACnet/IP to known engineering hosts
# Replace addresses with your environment values
iptables -A INPUT -p udp --dport 47808 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p udp --dport 47808 -j DROP