CVE-2026-22885 EnOcean SmartServer IoT Out-of-bounds Read
Remote attackers can send crafted IP-852 messages to leak memory from EnOcean SmartServer IoT devices, exposing sensitive data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-22885?
CVE-2026-22885 is a low-severity vulnerability in EnOcean Edge Inc SmartServer IoT, published on 20 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability exists in EnOcean SmartServer IoT version 4.60.009 and prior, which would allow remote attackers, in the LON IP-852 management messages, to send specially crafted IP-852 messages resulting in a memory leak from the program's memory.
Weakness: CWE-125
Which versions are affected by CVE-2026-22885?
How do I fix CVE-2026-22885?
No fix has been published for CVE-2026-22885 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-22885 being exploited?
There is no known exploitation of CVE-2026-22885 in the wild and no public exploit code.
Sources
Also known as GHSA-42qj-j5qx-4j25.