Exposed Building Automation Services: Bavaria and DACH

On 02.11.2026 I used Shodan to measure how much building automation in Germany is directly reachable from the internet. This is an English adaptation of my post; the full write-up is here: German original. The short version: a considerable number of services, most of them KNXnet/IP.

What I looked at

Building automation and control systems (BMS, German: Gebäudeleittechnik, GLT) cover everything that keeps a building running: heating, ventilation, air conditioning and refrigeration, lighting and blinds, energy meters, access control, and the control layer that ties it together. In many companies this technology belongs neither to IT nor to production. It sits with facility management or the electrical contractor, so few people look at it.

I used Shodan, which continuously scans the internet and identifies services by their responses. Shodan has its own detection for BACnet and KNX. I also searched for Tridium Niagara and included web interfaces of typical BMS products. I only counted totals and did not look at individual installations.

Important caveat: Shodan counts reachable services, not devices, and says nothing about whether a device is protected by additional measures.

How much building technology is reachable in Germany?

A considerable number of building automation services. The groups found, from largest to smallest:

In addition Shodan finds WAGO controllers with a web interface. WAGO runs in buildings and in industry, so I do not include them in the count.

Three notes on the counting:

• On the BACnet port Shodan reports far more hits than actually answer with BACnet. If you only count the port, you significantly overestimate the situation.
• Some of the BACnet responders report HikCentral Professional as the product, so not a classic building controller. I left them in anyway. My assessment: anyone who connects them via BACnet is linking them to the building technology.
• For Niagara, most hits were at Linode and Alibaba Cloud. My assessment: these are more likely test or research systems than buildings, so I only count the services outside these clouds.

Bavaria, Salzburg and Tyrol

Shodan also finds reachable BMS services in Bavaria, most of them KNXnet/IP.

In Austria, too, KNXnet/IP is a topic, including in the states of Salzburg and Tyrol. Switzerland also shows reachable KNXnet/IP services.

For our border region around Rosenheim this means KNX is the most important topic in building technology. A note on accuracy: Shodan assigns location via the IP address, which can also be the provider's headquarters.

How dangerous is this?

I rate the situation as high. According to CISA, an attacker with network access can access the KNX installation. The Shodan count does not show whether a gateway uses KNX Secure.

Exploitation is documented. In October 2021 a German engineering firm contacted Limes Security because it had lost control of a customer's building automation. Limes Security calls the attack wave KNXlock. According to Tech Times, citing Limes' analysis, an attacker wiped hundreds of devices over the internet and set their own password, the so-called BCU key. Lighting, blinds, heating, ventilation and air conditioning, and motion detectors failed, and the building ran on manual circuit breakers for weeks. According to the report, the estimated replacement cost was over 100,000 euros. For this vulnerability CISA published advisory ICSA-23-236-01 on 24.08.2023 (CVE-2023-4346, CVSS 7.5).

The web interfaces are no better. According to Shodan, all panels found from Saia PCD, Sauter moduWeb, eibPort and WAGO respond unencrypted over HTTP. Anyone logging in there risks sending their password in cleartext. According to Shodan, many moduWeb panels run on a Jetty web server version 7.6.16.

For Niagara I checked the software version with a somewhat broader query (only Linode and Alibaba excluded). Of these, a majority still report version 3.7 or 3.8.

Who is hit hardest?

Not every reachable KNX gateway is a disaster. A large share sit on connections of the largest access providers, mostly ordinary internet connections. My assessment: a good share of them are in private homes. It becomes critical where building technology secures operations:

• Data centers: cooling and ventilation decide availability.
• Food, cold storage, pharma: if temperature control fails, goods spoil.
• Hospitals and care facilities: ventilation, heating and access.
• Manufacturing halls in mechanical engineering: hall climate, compressed air and energy. A tampered ventilation or refrigeration system can stop production.

A production manager rightly thinks in terms of downtime and restart. The question is not whether someone makes the lights flicker, but how long the hall stands still if cooling fails and nobody has the key for the locked devices.

What I recommend to operators now

My recommendations:

1. Secure remote access: Never put building technology directly on the internet. Electricians and system integrators should only come in via VPN or a secured Remote Access path with a personal login per user.
2. Segment the network: Put the BMS in its own segment, separate from the office network and from production. Remove gateways left over from the construction phase after acceptance.
3. Know what you have: Put all KNX gateways, DDC controllers and web panels into your OT asset inventory. Check firmware, change default passwords, replace old panels and outdated Niagara versions. For KNX, set the BCU key and hand it to the owner together with the project documentation, as the KNX Association recommends in the CISA advisory. Demand KNX Secure for new builds.
4. Look at the traffic: Capture KNX and BACnet traffic and alert on write access from unknown stations. Attack detection in OT networks does exactly that.
5. Plan for emergencies: Who switches over manually on site? Where are the project data and keys? Who can be reached at the integrator? For the worst case there is OT incident response support.

"If you do not have your building technology in your asset inventory, you will not even know which system is being controlled by someone else in an emergency." Max Gilg, OT cybersecurity expert from Rosenheim

What NIS2 and the CRA have to do with it

For operators within the scope of NIS2, the network and information systems that keep their service running are part of risk management. My assessment: in data centers, hospitals and food production, building technology is part of that. For manufacturers of new connected BMS products, the Cyber Resilience Act is also relevant. For the installed base in the basement, both only help if someone knows the systems.

If you want to know where your own building technology stands, OT-Security in Bayern offers a point of contact. The same applies to Salzburg and Tyrol.

How I counted

The basis is the Shodan API, queried on 02.11.2026. Counted are services that responded in the last scan. A device with two open services can appear twice; devices behind a router without port forwarding are missing. Location follows the IP address. Vendor assignment is based on banner and page title. I do not publish individual addresses or installations.

If your maintenance and technical teams need to understand these risks, see Cyber-Awareness für Instandhaltung und Technik.

Original (German): https://ot-cyber.de/blog/1-500-offene-gebaeudesteuerungen-lage-bayern-und-dach.html

Max Gilg is an OT cybersecurity consultant based in Rosenheim, Germany (OT-Cyber.de).