LuxHawk.lu (+352) 27 52 67 45

← Back to knowledge

BMS and home automation: the building’s brain handed over to the Internet

Buildings and co-ownership 11 min Author : Arnaud Colin Updated : 06/10/2026

Summary

A building management system or a building’s home automation becomes attackable as soon as its gateway or its supervision interface answers from the Internet. In 2021, KNX installations were locked by a key set by the attacker (CVE-2023-4346, score 7.5, with no patch possible); in 2013, the supervision system of a Google building in Sydney was read through vulnerabilities patched nine months earlier. Before signing, require remote maintenance behind a VPN, a BCU key set and handed to the owner with the project, the removal of site gateways and a named person responsible for updates.

A building is now run over the network

In a recent building, the lighting of the common areas, the blinds, the ventilation, the heating and sometimes the doors are connected to a shared installation: the building management system (BMS) in commercial premises, home automation in residential ones. This installation has a brain – controllers, a supervision system – and, increasingly often, a gateway that lets the installer intervene without travelling to site. The convenience is real. The question a managing agent (syndic), a property manager or a company director needs to ask lies elsewhere: what happens when that gateway can be reached from the Internet by someone other than the installer, and how can this be checked before signing?

Two documented cases answer it precisely. The first, in German-speaking Europe from 2021 onwards, made three quarters of the components of an office building unusable without any ransom being demanded. The second, in Sydney in 2013, gave two researchers control of the supervision system of a Google building, nine months after the publication of the patch that would have been enough to prevent it.

KNXlock: the building locked by its own key (2021-2026)

KNX is a building automation standard widely deployed in Europe, as Dark Reading notes. Each component – switch, motion detector, blind control – can be protected by a “BCU key”, a four-byte programming password intended to prevent a third party from reprogramming the installation. The campaign known as KNXlock turns this protection against the owner.

In October 2021, a German engineering consultancy, according to Dark Reading, contacted the Austrian company Limes Security after losing control of the KNX installation in its client’s office building – “a mid-sized site”, Limes writes in its account. In mid-December 2021, a second European engineering consultancy reported an identical case; the attacker had come in through a forgotten site IP gateway, Dark Reading reports. On 30 March 2023, the technique was added to the MITRE ATT&CK for ICS knowledge base under reference T0892, “Change Credential”. On 24 August 2023, the US agency CISA published advisory ICSA-23-236-01: the vulnerability received the identifier CVE-2023-4346, CVSS score 7.5, and the agency wrote that it had received reports of active exploitation. On 30 January 2024, Limes described a variant of the campaign, with random keys and “system hacked bcu key …” messages, affecting private individuals as well as operators; on that occasion the company published the KNXunlocker tool. Finally, on 15 July 2026, CISA added CVE-2023-4346 to its Known Exploited Vulnerabilities catalogue, with a remediation deadline of 29 July 2026 (directive BOD 26-04).

The vector fits in one line: a KNXnet/IP gateway exposed on the Internet. The attacker “unloads” the components, then sets a BCU key that only they know. CISA classifies the flaw as an overly restrictive lockout mechanism (CWE-645) and specifies that it affects all KNX devices using the “Option 1 Style” authorisation mode on which no key has yet been set, across all versions. No software patch is offered: the advisory lists only operational measures. Once the key has been set by a third party, most devices allow it neither to be reset nor to be recovered, even with physical access, Limes writes. What made the attack possible was therefore not a technical feat but two absences: a gateway that should never have been reachable from outside, and a key that the integrator had not set.

The impact, in the first building, was physical. Around three quarters of several hundred components – switches, detectors, blind controls; no source mentions heating or ventilation – became unusable. The building ran for several weeks on its circuit breakers, and some components were rewired. The four manufacturers concerned replied that they could not recover the key. Limes estimates that replacing the hardware, installation and verification included, would have cost more than one hundred thousand euros. No ransom was demanded and no ransomware indicator was found; Limes raises the hypothesis of digital vandalism, or of an attacker who was unable to identify the operator. In August 2023, scans by Alpha Strike Labs, cited by Limes, counted more than 16,000 potentially vulnerable KNX systems exposed on the Internet in the German-speaking area.

The response was hand-crafted. Peter Panholzer and Felix Eberstaller, of Limes, physically extracted the memory of a component’s processor – which is only possible on devices without processor protection – narrowed the search space and recovered the key by brute force in 45 minutes, the same key having been set on every component; the installation was then reprogrammed in thirty minutes. KNXunlocker, the tool published in 2024, allows recovery “within a few hours using a regular PC” when the key follows a predictable pattern; when it cannot be recovered, the hardware remains permanently unusable. The KNX Association’s recommendations, taken up by CISA, fit in two sentences: always set the BCU key in every KNX project, and hand it over to the building owner with the project documentation.

Tridium Niagara: the supervision system of a Google building read from the Internet (2013)

Tridium Niagara (Honeywell) is the most widespread integration platform in building management: it brings heating, ventilation, lighting, energy and access control together behind a web interface. The case that follows is not a laboratory demonstration: two researchers took control of the supervision system of a building in operation.

The chronology begins a year before the intrusion. On 13 July 2012, the US ICS-CERT published alert ICS-ALERT-12-195-01 following a Washington Post investigation quoting the researchers Billy Rios and Terry McCorkle. On 15 August 2012, advisory ICSA-12-228-01 detailed the vulnerabilities and Tridium released a patch the same month. In May 2013, Rios and McCorkle, then at Cylance, spotted on the Internet the BMS of Google’s Wharf 7 building in Sydney, The Register reported on 6 May: it was running an old version of Niagara AX, embedded on QNX, which had not received the patch, around nine months after its publication.

The vector requires no new vulnerability: the 2012 flaws are enough. A directory traversal on the web interface (CVE-2012-4027) gives access to the config.bog configuration file, in which the credentials of every account are stored (CVE-2012-4028). The advisory notes two others: credentials encoded in base64 in a cookie (CVE-2012-3025) and predictable session identifiers (CVE-2012-3024). Public exploits were circulating, for more than 300,000 installations worldwide. What made the attack possible again comes down to two absences: an interface that should not have been answering from the Internet, and an update available for nine months that had not been applied.

The sequence of events is described by SecurityWeek. The researchers retrieved the configuration file – the administrator password was “anyonesguess” – and reached the supervision screens: the plan of the third level with the routing of the water pipes, the status of the kitchens, including a leak in progress in the south kitchen, and an “after hours” button marked with a hammer, which they refrained from testing. According to the same article, they had full control over the building’s security and heating-and-ventilation controls; they changed nothing. The impact is therefore limited to a demonstrated takeover, without damage. Cylance stated at the time that it had found more than 25,000 Niagara systems exposed on the Internet, compared with more than 2,500 at the time of the 2012 disclosure. The researchers reported their finding to Google through its vulnerability reward programme. The case is also reported by Infosecurity Magazine and The Register. The sources consulted report neither a statement from Google nor a date on which the system was disconnected.

Advisories that keep on coming

These two cases do not belong to the past. On 23 July 2025, Nozomi Networks published thirteen vulnerabilities, spread across ten identifiers (CVE-2025-3936 to CVE-2025-3945, maximum score 7.7 for CVE-2025-3937), in versions 4.10u10 and 4.14u1 of Niagara Framework and earlier. They are exploitable only on a misconfigured system, with encryption disabled or unencrypted Syslog logging; Tridium has patched them and no exploitation has been observed. On 10 March 2026, CISA published advisory ICSA-26-069-03 on Honeywell IQ4x controllers: CVE-2026-3611, score 9.8, a web interface without authentication by default, with no known public exploitation. These are risks, not incidents; they are a reminder that the question of updates is not settled once and for all.

The BSI, Germany’s Federal Office for Information Security, describes the same landscape in a warning of 4 April 2023 resulting from a field test, without naming KNX: remote maintenance access set up by contractors and left undocumented, no patch management, a BMS left outside the organisation’s security perimeter, and a risk of manipulation of door and fire-detection interlocks – while stating that it observed “no serious incidents yet”.

What this teaches a building or a co-ownership in Luxembourg

As at 18 September 2026, no Luxembourg case of a BMS or building home-automation hack is documented in a first-rank source. The 16,000 potentially vulnerable KNX systems exposed in the neighbouring German-speaking area were not exposed because of their country, but because their gateway was answering from the Internet. The steps that follow derive directly from the two cases.

  • In the contract and at handover of the works: require the integrator to set the BCU key on every component and to hand it to the owner, documented, with the ETS project file. The KNX Association and CISA put it in those terms; without it, the first comer sets the key in your place, and recovering it is not guaranteed.
  • The “temporary” site gateway: this is how the second case of 2021 was entered. Put it on the inventory and require its removal in the handover report.
  • No KNX/IP gateway or supervision interface reachable from the Internet: remote maintenance goes through a VPN, and the technical network is kept separate from the managing agent’s office IT as well as from the residents’ wifi. A supervision system accessible from outside can be found by a device search engine; the one in Sydney was spotted from the Internet.
  • Updates have an owner: the Niagara patch had existed since August 2012 and had not been applied nine months later. The question to put to the managing agent or the technical manager is simple: who updates the supervision system, and when?
  • The configuration file is the building’s key ring: an administrator password such as “anyonesguess”, or an interface delivered without authentication as CISA notes on the Honeywell IQ4x, is changed before commissioning, not after.
  • A copy of the project and of the key outside the installation: kept by the owner, not only by the installer, so that the installation can be reprogrammed if the installer disappears or ceases trading.
  • A fallback mode known to everyone: the 2021 building lived for several weeks on its circuit breakers. Knowing who turns the lights back on, opens the blinds and restarts the ventilation without the automation is part of the continuity plan, in the same way as the mechanical key to a door.
  • For CVE-2023-4346, there is no patch: only the architecture protects – no exposure on the Internet, a key set, and KNX Secure for new installations.
  • Digital vandalism exists: no ransom was demanded in 2021, and the building was nevertheless out of action. Reasoning only in terms of fraud or ransom leaves this scenario aside.
  • Exploitation acknowledged by an authority: CISA wrote it as early as August 2023 and only added the vulnerability to its catalogue in July 2026. Waiting for the official listing before acting would have meant waiting three years.

The notions of vulnerability, score and patch are explained in the article What is an IT security vulnerability?.

Sources