RWP Ventures RWP VenturesIntelligence

Historical intelligence backfill. This assessment covers reporting originally published on 2026-04-29 and was added to the RWP archive on 2026-09-07.

Daily Top · OT

EnOcean SmartServer turned a timezone IP-852 packet into pre-auth root on the BMS gateway

CVE-2026-20761 (CVSS 8.1) feeds a crafted LonTalk-over-IP message into system(); CVE-2026-22885 helps bypass ASLR. Patch is SmartServer 4.60.023. Legacy i.LON is in scope.

RWP Ventures · 2026-09-07 · event 2026-04-29 · 1 min read · priority 8.2

Bottom line up front

CONFIRMED Team82, 29 April 2026: EnOcean SmartServer IoT ≤4.60.009 (and legacy i.LON) mishandles a proprietary IP-852 timezone-setting packet. CVE-2026-20761: unauthenticated attacker controls an argument to system() → root RCE (CVSS 8.1). CVE-2026-22885: ASLR bypass / memory leak (CVSS 3.7). Vendor fix: SmartServer 4.6 Update 2 (v4.60.023). SecurityWeek matches the two CVEs and internet-exposed device warning. Ciphers notes CISA ICSA-26-050-01 (19 February 2026) as the coordinated advisory date — earlier than the technical blog. No confirmed in-the-wild OT outage in these sources. Process impact: ASSESSED (HVAC/power/environment if the gateway is live and reachable), not CONFIRMED victim.

Historical backfill of 29 April 2026 reporting; added 7 September 2026.

What happened

The CEA-852 research predicted this: a control packet with a shell metacharacter. Pre-auth because IP-852 was treated as a trusted building bus.

Why it mattered

SmartServer is the translator between LonWorks field devices and BACnet/Modbus/cloud. Root on the gateway is building-wide logic, not one thermostat.

Who / what was affected

SmartServer 4.60.009 and prior; i.LON. Internet-facing IP-852 is the realistic exploit condition.

Technical context

Patch. Disable IP-852 on untrusted interfaces. Hunt unexpected system children on the appliance. Do not confuse "CISA advisory in February" with "blog in April" — same bugs, two publication layers.

Exploitation / threat status at the time

CONFIRMED vulns + vendor patch.

UNKNOWN exploitation.

What defenders should have done

  1. 4.60.023 or isolate.
  2. External scan for SmartServer/i.LON.
  3. Assume BMS logic is hostile if IP-852 was WAN-reachable.

RWP assessment

Confidence: High. This is the implementation of the LonTalk-over-IP problem, not a new class.

Defensive actions

  1. Firmware inventory for EnOcean/i.LON.
  2. No LonTalk-over-IP from the internet.
  3. After patch, rotate credentials stored on the box.

Sources

  1. Claroty Team82 — Exploiting EnOcean SmartServer to attack connected BMS
  2. SecurityWeek — EnOcean SmartServer flaws expose buildings to remote hacking
  3. Ciphers Security — CVE-2026-20761 RCE summary

Related intelligence