BACnet (Building Automation and Control Networks) is the dominant protocol for building automation systems worldwide. HVAC controls, fire alarm systems, elevator controllers, lighting systems, and physical access control systems all use BACnet in commercial buildings, data centers, hospitals, airports, and government facilities. The protocol is standardized under ASHRAE 135 and ISO 16484-5.
BACnet/IP — the Ethernet-based variant that carries BACnet packets over UDP — has a fundamental security property that practitioners need to understand: the base protocol has no authentication, no encryption, and no mechanism to prevent unauthorized devices from reading or writing building system parameters. Any device on the network with access to UDP port 47808 can interact with BACnet controllers.
How BACnet/IP Works
BACnet uses an object model to represent building automation components. Each device exposes a set of objects (air handlers, thermostats, VAV boxes, dampers, pumps) each with properties (present value, set point, mode, status). Controllers communicate by reading and writing these properties.
The core discovery mechanism is a broadcast-based exchange:
- Who-Is — a broadcast query asking all BACnet devices on the network to identify themselves
- I-Am — each device responds with its device identifier and network address
After discovery, a controller or management system can:
- ReadProperty / ReadPropertyMultiple — read values from any object on any discovered device
- WriteProperty — write values to any writable object, including set points and operational parameters
- ReinitializeDevice — reboot a BACnet device remotely
None of these operations require authentication in the base BACnet/IP protocol. Any device that can send and receive UDP packets on the BACnet network segment can issue these commands to any BACnet controller.
Internet Exposure
Shodan and Censys enumeration of UDP port 47808 consistently returns thousands to tens of thousands of internet-accessible BACnet devices globally. The exposure exists for several reasons:
Building management systems (BMS) are frequently managed by third-party facility management contractors who require remote access. Where proper remote access architecture (VPN, jump hosts, industrial firewalls) hasn’t been implemented, direct internet exposure is the shortcut taken.
Building automation networks are often on the same flat network as IT infrastructure or, in older installations, have direct internet routing from equipment installed before cybersecurity was a design consideration. Unlike IT networks, BAS networks may not have received the same network segmentation investment.
The Who-Is/I-Am discovery works across broadcast domains with BACnet Broadcast Management Devices (BBMDs), which facilitate discovery across IP subnets — and in some configurations, across internet-routed connections.
Attack Scenarios
Environmental manipulation in data centers. A BACnet-accessible data center building automation system controls cooling. An attacker who can write to the cooling system’s set points or operational parameters can manipulate temperature thresholds, disable cooling units, or force systems into fault states. The target is equipment damage or forced shutdown through thermal events. Data center facilities in multiple incidents have had their cooling systems manipulated through building automation access.
Hospital HVAC disruption. Hospital HVAC systems maintain pressurization in operating rooms, isolation rooms for infectious disease patients, and pharmaceutical storage areas. BACnet write access to room pressurization controllers can affect these environments. The consequence in a healthcare facility can extend beyond discomfort to patient safety outcomes.
Physical access control integration. Some building access control systems are integrated with BACnet for monitoring — door status, lock state — and in some implementations, control. BACnet access to integrated systems may provide the ability to read door status or, in poorly designed integrations, send commands that affect access control behavior.
Reconnaissance for physical intrusion. Read access to BACnet systems provides detailed building state information: which areas are occupied (based on presence sensors and HVAC demand), security system states, elevator positions, fire alarm states. This reconnaissance capability has practical value for adversaries planning physical operations.
Ransomware-adjacent disruption. Building automation disruption has appeared in the context of broader ransomware incidents targeting facilities. An attacker with access to an organization’s network who also has a path to the BAS can use BACnet access to cause operational disruption as additional leverage or to force a physical response that disrupts recovery operations.
Shodan Exposure Example
A basic Shodan query for internet-facing BACnet devices:
port:47808 product:BACnetThe results include device identifiers, vendor names, object identifiers, and in many cases property values directly exposed through the response to Who-Is queries. This represents immediate reconnaissance capability for any attacker with internet access — no authentication required to discover device types, firmware versions, and building system inventory.
Specific Shodan searches can target BACnet devices from specific vendors (Schneider Electric EcoStruxure components, Siemens Desigo, Honeywell WEBs, Automated Logic) or in specific geographies. Threat actors conducting targeted facility operations have used public BACnet enumeration to identify and characterize targets before attempting access.
BACnet Secure Connect (BACnet SC)
The ASHRAE 135 standard was amended in 2020 to add BACnet Secure Connect (BACnet SC, Addendum bj). BACnet SC addresses the base protocol’s security deficiencies:
- TLS 1.3 encryption for all BACnet SC communications
- Certificate-based authentication using X.509 certificates
- Hub-and-spoke topology replacing the broadcast-based discovery model, with a primary hub authenticating devices before they join the network
- Mutual TLS (mTLS) — both endpoints authenticate in connections between devices
BACnet SC provides the security properties absent from BACnet/IP. The adoption challenge is significant: BACnet SC requires updated firmware or hardware on existing controllers, and the installed base of BACnet/IP devices is vast. Legacy controllers from the 2000s and 2010s will not receive BACnet SC firmware updates and cannot participate in secure communication without replacement.
In practice, BACnet SC adoption is growing primarily in new installations and system refreshes. Existing BACnet/IP installations will operate without authentication for years or decades, depending on capital refresh cycles.
Hardening: What Can Be Done Now
Network Segmentation as Primary Control
The most effective control for BACnet/IP is network isolation. BACnet devices should be on a dedicated network segment with no direct routing to IT networks or the internet. Access from IT systems (BMS management workstations, integration servers) should pass through a dedicated industrial firewall or DMZ that restricts the protocols and source addresses permitted to communicate with BACnet devices.
Firewalling UDP 47808 at the perimeter is a minimum requirement. Monitoring and logging all access to that port from permitted IP ranges provides the visibility needed to detect anomalous activity.
Access architecture:
Internet → [Perimeter Firewall] → IT Network
↓ VPN-only remote access
[Industrial Firewall/DMZ]
↓ Restricted BACnet/IP
[BAS Network - BACnet/IP]
↓
[BACnet Controllers - HVAC, etc.]Remote access for facility management contractors should be over a dedicated VPN terminating in the BAS network DMZ, not direct internet exposure to BACnet controllers.
Implement BACnet SC Where Possible
For new installations and refreshed systems, require BACnet SC capable controllers and configure it. Verify vendor support before procurement — not all current controllers support BACnet SC even now. Where legacy devices mix with SC-capable devices, use protocol translation or gateway devices to bridge traffic rather than operating a flat unauthenticated network.
Device Discovery Monitoring
Monitor the BACnet network for unexpected Who-Is/I-Am exchanges. Authorized BACnet devices on a well-managed network have a known inventory. An unexpected I-Am response (a device not in the inventory) warrants investigation — it may indicate an unauthorized device added to the network segment. Passive network monitoring tools (Claroty, Dragos, Nozomi Networks) can provide BACnet-aware device inventory and anomaly detection.
WriteProperty Command Monitoring
Log WriteProperty operations on BACnet controllers, particularly writes to set points and operational parameters. Modern BACnet building management systems support audit logging. Changes to set points outside normal operational ranges, or changes occurring outside maintenance windows, are worth alerting on.
Disable Unnecessary Features
Some BACnet controllers expose features not required for normal operation. Disable BACnet device services that aren’t used, particularly those that allow firmware updates or configuration changes from the network. ReinitializeDevice should be access-controlled where the controller supports it.
Vendor Assessment Before Procurement
When procuring new building automation equipment, require vendors to document:
- BACnet SC support status and configuration requirements
- Authentication and access control capabilities
- Firmware update process and security advisory history
- Network isolation requirements and documentation
Building automation procurement decisions are typically made by facilities teams rather than security teams. Including OT security requirements in the procurement process and involving security in vendor evaluation reduces the probability of deploying systems that immediately create exposure.
Priority Actions
For organizations with existing BACnet/IP installations:
- Audit internet exposure of UDP 47808 using Shodan or Censys against your own IP ranges
- Implement network segmentation if the BAS is currently on a flat network with IT systems
- Require VPN for all remote access to BAS networks; eliminate direct internet exposure
- Establish device inventory for all BACnet controllers and enable anomaly detection
- Engage the BMS vendor on BACnet SC roadmap for the installed platform
The security posture of building automation systems has historically been treated as a facilities management responsibility. As demonstrated by incidents affecting data centers, hospitals, and government facilities, BAS security is an OT security problem requiring the same network segmentation and access control principles applied to industrial control systems in other critical sectors.