EnOcean SmartServer Flaws Expose Buildings to Remote Hacking
Source SecurityWeek
Mentioned vulnerabilities
Rated Critical by SecurityWeek
Data as of 30 Apr 2026, 12:06 UTC
What to do
AI-suggested
EnOcean has released an official patch in SmartServer version 4.6 update 2 (4.60.023) that addresses these vulnerabilities. Users should apply this update promptly to mitigate the risk. The vendor advisory confirms the availability of this fix. No additional mitigation steps are specified beyond applying the official update. Legacy i.LON device users should verify patch availability or vendor guidance for those products.
Description
Two critical vulnerabilities were discovered in EnOcean's SmartServer IoT platform, enabling remote attackers to bypass security controls and execute arbitrary code with root privileges. These flaws affect internet-exposed SmartServer devices used in building automation, potentially allowing full takeover of Linux-based systems managing smart buildings, factories, and data centers. The vulnerabilities, tracked as CVE-2026-22885 and CVE-2026-20761, involve improper validation of packet input leading to memory protection bypass and remote code execution. EnOcean has released SmartServer 4.6 update 2 (4.60.023) to address these issues. Legacy i. LON devices are also impacted. Claroty researchers have published technical details and proof-of-concept exploits.