Description
A vulnerability exists in EnOcean SmartServer IoT version 4.60.009 and prior, which would allow remote attackers, in the LON IP-852 management messages, to send specially crafted IP-852 messages resulting in arbitrary OS command execution on the device.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
EnOcean Edge Inc SmartServer IoT
Default version status: unaffected
0 to ≤ 4.60.009affected4.60.023unaffected
References
- https://enoceanwiki.atlassian.net/wiki/spaces/DrftSSIoT/pages/1475410/SmartServer+IoT+Release+Notes#Current-Stable-Release ↗
- https://enoceanwiki.atlassian.net/wiki/spaces/IEC/pages/288063529/Enhancing+Security ↗
- https://www.cisa.gov/news-events/ics-advisories/icsa-26-050-01 ↗
- https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-050-01.json ↗