CVE-2026-20761

CVE Enrichment

CVSS: 8.1 HIGH
EPSS: 1.03%
EPSS Percentile: 63.65%
CISA KEV: Not listed

Description

A vulnerability exists in EnOcean SmartServer IoT version 4.60.009 and prior, which would allow remote attackers, in the LON IP-852 management messages, to send specially crafted IP-852 messages resulting in arbitrary OS command execution on the device.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: [email protected]
Published: 20-Feb-2026 23:22
Last Modified: 17-Jun-2026 17:17
EPSS Date: 2026-11-03
CWE: CWE-77

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:H /
                            PR:N /
                            UI:N /
                            S:U /
                            C:H /
                            I:H /
                            A:H

CNA Products / Version Status

EnOcean Edge Inc · SmartServer IoT Source: CNA · [email protected]
Default status: unaffected

0 ≤ version ≤ 4.60.009 — affected (custom)
4.60.023 — unaffected

References

Last enrichment sync: 04-Nov-2026 15:19
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

According to Claroty: “CVE-2026-20761 allows remote attackers to send malicious, crafted LON IP-852 messages that result in arbitrary command execution on devices. Weekly Cybersecurity Recap: Active cPanel and Linux Exploits, Supply-Chain Attacks and New Malware

CVE (4)

Malware (8)

People (1)

Threat Actors (9)

MITRE ATT&CK (14)

Vendors (6)

Products (9)

Tools (3)

Industries (8)

Countries (6)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.