CVE-2026-22885

CVE Enrichment

CVSS: 3.7 LOW
EPSS: 0.43%
EPSS Percentile: 37.32%
CISA KEV: Not listed

Description

A vulnerability exists in EnOcean SmartServer IoT version 4.60.009 and prior, which would allow remote attackers, in the LON IP-852 management messages, to send specially crafted IP-852 messages resulting in a memory leak from the program's memory.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: [email protected]
Published: 20-Feb-2026 23:22
Last Modified: 17-Jun-2026 17:20
EPSS Date: 2026-11-03
CWE: CWE-125

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:H /
                            PR:N /
                            UI:N /
                            S:U /
                            C:L /
                            I:N /
                            A:N

CNA Products / Version Status

EnOcean Edge Inc · SmartServer IoT Source: CNA · [email protected]
Default status: unaffected

0 ≤ version ≤ 4.60.009 — affected (custom)
4.60.023 — unaffected

References

Last enrichment sync: 04-Nov-2026 15:22
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

CVE-2026-22885 allows remote attackers to send malicious, crafted IP-852 messages that bypass ASLR memory protections and leak memory.” Successful exploitation of the flaws results in attackers obtaining control over Weekly Cybersecurity Recap: Active cPanel and Linux Exploits, Supply-Chain Attacks and New Malware

CVE (4)

Malware (8)

People (1)

Threat Actors (9)

MITRE ATT&CK (14)

Vendors (6)

Products (9)

Tools (3)

Industries (8)

Countries (6)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.