Assessing the BACnet Control System Vulnerability

McAfee disclosed a buffer-overflow vulnerability in the BACnet BVLC handling of Delta Controls' eBMGR building management controller that can be triggered by an oversized length field, enabling remote code execution; Dragos noted the exploitation risk is limited but stressed that BACnet is insecure-by-design and freely available tools already permit manipulation of Internet-connected building systems. The report outlines potential impacts to HVAC, access control, and other building systems, practical mitigations (restrict UDP/47808, use VPNs, isolate controllers), and coordination with the Cyber Threat Alliance to distribute IDS signatures.