Black Hat Europe 2025: Was that device designed to be on the internet at all?

The article reports on research presented at Black Hat Europe 2025 revealing that a widely deployed building management system contains legacy vulnerabilities and is often hosted on public IP addresses; researchers warn this exposure—combined with outdated firmware and deficient security auditing during mergers—could enable attackers to cause significant operational or physical disruptions, and they recommend full code audits, timely patching, and placing such systems behind VPNs or equivalent access controls.