8.1 HighCWE-77
CVE-2026-20761
EnOcean SmartServer IoT Command Injection
EnOcean Edge IncSmartServer IoT
Status
- Not in CISA KEV
- Vendor fix available
Exploit probabilityEPSSchecked 24 Oct
1.0%probability of exploitation in the next 30 days
Higher than 63% of scored CVEs
SeverityCVSS
8.1High
Description NVD
A vulnerability exists in EnOcean SmartServer IoT version 4.60.009 and prior, which would allow remote attackers, in the LON IP-852 management messages, to send specially crafted IP-852 messages resulting in arbitrary OS command execution on the device.
Coverage 1 article · 1 outlet
- Remote flaws in EnOcean SmartServer expose buildings to hackingSecurityWeek · first in our coverage · mentions it in passing