Security readout for executives and security teams
Plain-English summary
BACnet Test Server can be crashed remotely by malformed BACnet/IP traffic. The issue is denial of service, not data theft or code execution, but it can still disrupt testing or exposed operational environments using this server.
Executive priority
Prioritize if BACnet Test Server is exposed beyond a controlled lab or management network. For isolated test-only deployments, urgency is lower but remediation should still be tracked.
Technical view
The vulnerability is in BACnet/IP BVLC packet handling. Sources state the server does not properly validate the BVLC Length field in UDP BVLC frames on port 47808, causing an access violation and application crash. Reported affected scope is BACnet Test Server up to and including 1.01, though supplied affected metadata is inconsistent.
Likely exposure
Exposure is likely limited to environments running BACnet Test Server, especially if BACnet/IP UDP 47808 is reachable from untrusted networks. This should not be assumed to affect all BACnet products.
Exploitation context
The source bundle includes public exploit references, but CISA KEV status is false and no cited source states active exploitation. Treat exploitability as publicly demonstrated, not confirmed in-the-wild exploitation.
Researcher notes
Do not generalize this to building controllers or other BACnet stacks without evidence. Version evidence is imperfect: narrative says through 1.01, while structured affected data lists version 0 with defaultStatus unaffected.
Mitigation direction
- Check vendor guidance for fixed versions, replacement builds, or official mitigation advice.
- Remove or disable BACnet Test Server where it is not required.
- Restrict UDP 47808 exposure to trusted management or test networks only.
- Block untrusted BACnet/IP traffic at network boundaries.
- Monitor for unexpected crashes or restarts of the test server process.
Validation and detection
- Inventory systems running BACnet Test Server and record exact versions.
- Confirm whether UDP 47808 is reachable from untrusted networks.
- Review crash logs for access violations in the BACnet Test Server process.
- Compare installed versions against vendor or CVE guidance.
- Verify compensating network controls limit BACnet/IP access.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-400: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2020-36872 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.7 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N——VulnCheckVulnerability scoring details
Base CVSS 4.0 score
8.7HighVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- Source timelineVulnCheck
Exploit is publicly disclosed
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5597.phpCVE reference, VulnCheck · technical-description, exploit
- https://www.exploit-db.com/exploits/48860CVE reference, VulnCheck · exploit
- https://packetstormsecurity.com/files/159504CVE reference, VulnCheck · exploit
- https://cxsecurity.com/issue/WLB-2020100045CVE reference, VulnCheck · exploit
- https://www.bac-test.com/CVE reference, VulnCheck · product
- https://www.vulncheck.com/advisories/bacnet-test-server-malformed-bvlc-length-dosCVE reference, VulnCheck · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Uncontrolled Resource Consumption
Uncontrolled Resource Consumption represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.