17K Building Control (BACnet) Servers Connected to the Internet

This report outlines the large internet-exposed footprint of BACnet building automation systems (Censys finds ~16.9K devices) and highlights that more than 2,000 Niagara AX/4 devices are likely vulnerable to CVE-2017-16744 (remote code execution, CVSS 7.4). It explains the risks to physical building infrastructure, common misconfiguration and patching gaps, and recommends mitigations including network isolation, microsegmentation, stronger authentication, and timely patching.