CVE-2019-12480
BACnet Protocol Stack through 0.8.6 could allow an unauthenticated, remote attacker to cause a...
BACnet Protocol Stack through 0.8.6 has a segmentation fault leading to denial of service in BACnet APDU Layer because a malformed DCC in AtomicWriteFile, AtomicReadFile and DeviceCommunicationControl services. An unauthenticated remote attacker could cause a denial of service (bacserv daemon crash) because there is an invalid read in bacdcode.c during parsing of alarm tag numbers.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
BACnet Protocol Stack through 0.8.6 has a segmentation fault leading to denial of service in BACnet APDU Layer because a malformed DCC in AtomicWriteFile, AtomicReadFile and DeviceCommunicationControl services. An unauthenticated remote attacker could cause a denial of service (bacserv daemon crash) because there is an invalid read in bacdcode.c during parsing of alarm tag numbers.
- Record
CVE-2019-12480- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-125
- Updated
- 2026-11-02
CVE List No score
BACnet Protocol Stack through 0.8.6 has a segmentation fault leading to denial of service in BACnet APDU Layer because a malformed DCC in AtomicWriteFile, AtomicReadFile and DeviceCommunicationControl services. An unauthenticated remote attacker could cause a denial of service (bacserv daemon crash) because there is an invalid read in bacdcode.c during parsing of alarm tag numbers.
- Record
CVE-2019-12480- Updated
- 2026-11-02
EUVDEUVD-2019-4076 No score
BACnet Protocol Stack through 0.8.6 has a segmentation fault leading to denial of service in BACnet APDU Layer because a malformed DCC in AtomicWriteFile, AtomicReadFile and DeviceCommunicationControl services. An unauthenticated remote attacker could cause a denial of service (bacserv daemon crash) because there is an invalid read in bacdcode.c during parsing of alarm tag numbers.
- Record
EUVD-2019-4076- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-cc8w-j726-c7gj No score
BACnet Protocol Stack through 0.8.6 could allow an unauthenticated, remote attacker to cause a...
BACnet Protocol Stack through 0.8.6 could allow an unauthenticated, remote attacker to cause a denial of service (bacserv daemon crash) because there is an invalid read in bacdcode.c during parsing of alarm tag numbers.
- Record
GHSA-cc8w-j726-c7gj- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | BACnet Stack 0.8.6 - Denial of Service | 2019-07-22 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-12480 is a high vulnerability (CVSS 7.5) in Bacnet Protocol Stack Project Protocol Stack, published May 30, 2019. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 33.9%, the 98th percentile. No source names a fixed version.
References
sourceforge.net/p/bacnet/bugs/62
packetstormsecurity.com/files/153716/BACnet-Stack-0.8.6-Denial-Of-Service.html
1modm.github.io/CVE-2019-12480.html
nvd.nist.gov/vuln/detail/CVE-2019-12480
github.com/advisories/GHSA-cc8w-j726-c7gj