Assessing the BACnet Control System Vulnerability
Summary: McAfee researcher Douglas McKee disclosed a buffer overflow in Delta Controls' eBMGR, a combined BACnet gateway and controllable building controller running embedded Linux, where a BVLC header length field larger than the 1476-byte standard is not sanitized before a memcpy() call. McAfee achieved full remote code execution with the bug, though Dragos assessed the risk of exploiting a BACnet controller as low, noting freely available tools can already connect to Internet-connected building systems and modify their operation without an exploit.
Bottom line: The same protocol lets an attacker join as a Foreign Device and issue HVAC commands without any exploit at all, and a persistent attacker who keeps crashing the controller could hold an output asserted indefinitely - a scenario Dragos flags as riskiest for data centers, where a failing air handling system could cause computers to melt.
Read the original at Dragos Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026