CVE-2016-4494: KMC Controls BAC-5051E BACnet Router CSRF Discloses Device Configuration

CVE-2016-4494 is a cross-site request forgery flaw (CWE-352) in the web interface of KMC Controls' BAC-5051E BACnet router, a building-automation networking device that routes BACnet traffic between IP, Ethernet and MS/TP controller networks: an attacker can trick a logged-in administrator's browser into issuing a forged request that discloses the contents of the router's configuration file, and NVD has published its own Primary CVSS v3.0 score of 8.8 (high) for the flaw.

CVE-2016-4494 (CWE-352, cross-site request forgery) affects KMC Controls' BAC-5051E, a multi-port BACnet router from KMC's Conquest line that routes BACnet traffic between BACnet/IP, Ethernet and MS/TP segments of a building's control network and is managed entirely from a browser — "configurable using only an Internet browser, with no special software to learn or load" — rather than a dedicated engineering tool (KMC Controls BAC-5051E router product page). NVD's description states: "Cross-site request forgery (CSRF) vulnerability on KMC Controls BAC-5051E devices with firmware before E0.2.0.2 allows remote attackers to hijack the authentication of unspecified victims for requests that disclose the contents of a configuration file" (NVD).

NVD lists its own Primary CVSS v3.0 base score of 8.8 (high), vector CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H — network-reachable, low attack complexity, no privileges required, though it does require a logged-in victim to interact with the attacker's page (NVD).

The same device and firmware also carry a companion flaw, CVE-2016-4495 (CWE-306, missing authentication for a critical function), which lets an attacker read the configuration file directly without needing to hijack a session at all; NVD gives that CVE a separate, lower Primary CVSS v3.0 score of 5.3 because it needs no victim interaction but discloses less of the file's sensitivity in NVD's scoring model (NVD).

CISA's advisory ICSA-16-126-01, credited to independent researcher Maxim Rupp, states that "BAC-5051E routers are used in Commercial Facilities" and are deployed across the Americas, the Middle East and Southeast Asia. The advisory describes the pair of flaws as: "An unauthorized user can use a CSRF attack to read configuration data from a file" (CVE-2016-4494) and "A missing authorization check allows an unauthorized user to read configuration data from a file" (CVE-2016-4495) (CISA ICS Advisory ICSA-16-126-01).

CISA's recommended mitigation is to upgrade to firmware version E0.2.0.2, and in the meantime to "install the router behind a firewall inside a site's intranet network," minimize internet exposure for control-system devices generally, and use a VPN for any remote access that is required (CISA ICS Advisory ICSA-16-126-01).

This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of catalog version 2026.11.06, and FIRST scores the probability of exploitation at 0.00602 (49.048th percentile) as of 2026-11-07 — a confirmed high-severity flaw in a widely deployed building-network device with no reported in-the-wild exploitation (CISA KEV, FIRST EPSS).

Any BAC-5051E router still running firmware older than E0.2.0.2 should be upgraded and kept off the open internet; because the BAC-5051E is now a discontinued product, sites planning a longer-term refresh should evaluate KMC's current BAC-5051AE successor router.

• CSRF vulnerability on KMC Controls BAC-5051E devices with firmware before E0.2.0.2 allows remote attackers to hijack the authentication of a victim for requests that disclose the contents of a configuration file. — NVD
• NVD Primary CVSS v3.0 base score 8.8 (high), vector CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. — NVD
• Companion CVE-2016-4495 (CWE-306, missing authentication) lets an attacker read the configuration file without hijacking a session; NVD Primary CVSS v3.0 base score 5.3. — NVD
• BAC-5051E routers are used in the Commercial Facilities sector, deployed across the Americas, Middle East and Southeast Asia; reported by independent researcher Maxim Rupp; mitigation is to upgrade to firmware E0.2.0.2 and install the router behind a firewall inside the site's intranet. — CISA ICS Advisory ICSA-16-126-01
• The BAC-5051E router is configurable entirely through a browser interface and is now listed as a discontinued product, with the BAC-5051AE as its successor. — KMC Controls BAC-5051E router product page
• Not present in the CISA KEV catalog as of catalog version 2026.11.06; EPSS score is 0.00602 (49.048th percentile) as of 2026-11-07. — FIRST EPSS