CVE-2025-13926
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · uneditedAn attacker could use data obtained by sniffing the network traffic to forge packets in order to make arbitrary requests to Contemporary Controls BASC 20T.
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · moderate confidenceThe Contemporary Controls BASC 20T transmits network data without adequate protection, allowing an attacker who sniffs traffic to obtain session credentials or command structures. The attacker can then forge or replay these packets to make arbitrary requests to the device, likely bypassing authentication due to the lack of encryption or anti-replay safeguards on the communication channel.
Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.
CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector- Attack vector
- Network
- Complexity
- Low
- Privileges
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.
dbcve checksWork through these to decide whether this CVE applies to you.
-
Identify the BASC 20T device on your networkUse network scanning tools (such as nmap, Angry IP Scanner, or your network management system) to discover devices. Look for devices with hostname, MAC OUI matching Contemporary Controls, or port signatures indicating BAS protocols. Confirm the exact model number through device documentation or management interface.Affected if The device on your network is confirmed to be a Contemporary Controls BASC 20T controller.
-
Capture and inspect outbound network trafficUse a packet capture tool (such as Wireshark or tcpdump) on a span port or tap positioned to observe traffic to and from the BASC 20T. Filter for traffic involving the device IP and examine the protocol layers. Look for cleartext protocols, unencrypted application-layer data, or recognizable BAS protocol patterns.Affected if Network traffic to/from the device is transmitted in cleartext without TLS or equivalent encryption layer.
-
Check for encryption on BAS protocol communicationExamine captured packets for the presence of TLS/SSL handshake (ClientHello, ServerHello) or other encryption indicators. For BAS protocols (BACnet, Modbus, or proprietary), verify whether encryption options are available and enabled in the device configuration.Affected if The device uses an unencrypted BAS protocol without TLS wrapping or equivalent transport encryption.
-
Inspect for sensitive data exposure in trafficWithin captured packets, search for visible usernames, passwords, device credentials, session tokens, or command structures that could be extracted and reused to forge requests. Use Wireshark follow-stream or strings to examine payload content.Affected if Cleartext credentials, session identifiers, or predictable command structures are observable in captured network traffic.
-
Verify network isolation of the deviceReview network segmentation policies, VLAN assignments, and firewall rules to determine whether the BASC 20T is isolated from untrusted networks or the internet. Check if the device is directly accessible from management or guest networks.Affected if The BASC 20T lacks network isolation and is reachable from untrusted network segments, combined with unencrypted communications.
Your environment is affected if the BASC 20T transmits network traffic in cleartext or uses unencrypted protocols, allowing an attacker with packet capture ability to extract sufficient information for crafting forged requests.
Generated from the published advisory. Verify against your own configuration.
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
From vendor dataIsolate the BASC 20T on a dedicated, firewalled network segment; if remote access is required, tunnel communications through a VPN with encrypted tunnels to prevent sniffing and packet forgery.
- Consultation4.0 h
- Implementation12.0 h
- Testing6.0 h
- Review / QA4.0 h
An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $7,328.
Scan for this in your stack
Free · runs locallyCheck whether your project pulls in CVE-2025-13926 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Primary sourcesPractitioner notes
ContributedPeer-ranked notes from engineers who’ve handled CVE-2025-13926 in production — separate from our analysis above.
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
- The version that genuinely resolved it — not the one the vendor claimed
- A config change or rule that shut the vector down
- A gotcha in the upgrade path that cost you an afternoon
No notes yet
Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
- Verified mitigations, workarounds, and config changes
- Version or environment caveats, and links to real fixes
- No weaponised exploit code, or anything meant to cause harm
- No spam, self-promotion, credentials, or personal data