The object name of a dynamically created BACnet File Object is interpreted as a file path without sufficient validation.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Oct 1, 2026 · NIST NVD

   Detected

   The object name of a dynamically created BACnet File Object is interpreted as a file path without sufficient validation. Because relative paths are not limited to the intended directory, an unauthenticated remote attacker can traverse outside of it and read or overwrite arbitrary files on the device, which may lead to full system compromise.

2. Oct 14, 2026 · NIST NVD

   Updated

   The object name of a dynamically created BACnet File Object is interpreted as a file path without sufficient validation. Because relative paths are not limited to the intended directory, an unauthenticated remote attacker can traverse outside of it and read or overwrite arbitrary files on the device, which may lead to full system compromise.

Sources

• CVE.orgVulnerability recordCVE-2025-41753

  Official CVE identifier

  cve.org
• FIRST EPSSExploitation probabilityCVE-2025-41753

  30-day exploitation probability 0.6%

  first.org
• NIST NVDVulnerability recordCVE-2025-41753

  The object name of a dynamically created BACnet File Object is interpreted as a file path without sufficient validation. Because relative paths are not limited to the intended directory, an unauthenticated remote attacker can traverse outside of it and read or overwrite arbitrary

  nvd.nist.gov

References

• Reference · certvde.com