BACnet or "BADnet"? On the (In)Security of Implicitly Reserved Fields in BACnet

BACnet or "BADnet"? On the (In)Security of Implicitly Reserved Fields in BACnet

Speakers: Qiguang Zhang

Conference: NDSS Symposium 2026

YouTube: https://www.youtube.com/watch?v=jFtBBwt5phY

Overview

Building Automation Systems (BAS) control heating, ventilation, air conditioning, lighting, security subsystems, and door locks in commercial buildings worldwide, with the BACnet protocol commanding over 70% market share. Yet the security of BACnet device implementations has received surprisingly little scrutiny, in part because traditional fuzzing approaches face severe challenges: no source code access, no firmware availability, no internal state visibility, and physical-layer throughput constraints that throttle packet transmission to just a few packets per second. This talk introduces BACFuzz, the first protocol-behavior-driven fuzzer for BAS devices, which uses LLM-assisted specification parsing to automatically identify error-prone "implicitly reserved fields" in the BACnet protocol, bypasses the MS/TP token-passing mechanism to achieve a 700% throughput improvement, and uncovers 26 vulnerabilities across 20 devices from 9 vendors -- with 24 confirmed and 9 assigned CVEs. One finding was acknowledged by the BACnet community as a protocol-level flaw in the MS/TP specification itself.

Background

▶ Watch: BACnet architecture and the BACnet SC secure connection setup (1:00)

Building Automation Systems represent a massive attack surface in commercial real estate, healthcare facilities, data centers, and government buildings. These systems control physical infrastructure -- HVAC, lighting, access control, fire safety -- through networked devices that communicate using specialized protocols designed decades ago with minimal security considerations.

BACnet (Building Automation and Control Networks) is the dominant protocol in this space. Unlike IT network protocols, BACnet does not run over standard TCP/IP and Ethernet in most deployments. Instead, the majority of BACnet devices use MS/TP (Master-Slave/Token-Passing), a data link layer protocol that operates over RS-485 serial bus. MS/TP uses a token-passing mechanism where all devices on a local bus share a single token -- only the device holding the token can transmit. This creates an extreme throughput bottleneck for fuzzing: with multiple devices on a bus, only two out of many message exchanges involve actual data transmission, with all others dedicated to token management.

BACnet operates across multiple layers -- application layer, network layer, and data link layer -- each with distinct message types and field structures. The protocol specification is notoriously poorly written, with confusing terminology (for example, referring to the IP layer as the "physical layer" due to treating BACnet as an overlay protocol). This specification quality issue directly contributes to implementation errors.

Security testing of BAS devices faces unique challenges compared to IT systems: no source code is available, firmware is rarely extractable, internal device states cannot be monitored, and the physical-layer throughput constraints of MS/TP make traditional fuzzing impractically slow.

Key Findings

▶ Watch: Key idea: implicitly reserved fields are more error-prone (5:00)

The most striking finding is that 100% of discovered vulnerabilities occurred in what the researchers call implicitly reserved fields -- protocol fields where the specification defines values for some of the possible bit patterns but silently ignores the rest, without explicitly marking them as reserved. This contrasts with explicitly reserved fields (where the specification says "all other values are reserved") and fully defined fields (where every possible value has a defined meaning).

The researchers found that BACnet device implementations consistently fail to handle undefined values in these implicitly reserved fields, either crashing, hanging, or responding in ways that violate the specification. Across 20 devices from 9 vendors, including major manufacturers like Siemens (7 devices, 11 vulnerabilities) and Johnson Controls (1 device, 0 vulnerabilities -- though the researchers note they only had one device from this vendor), the assessment revealed 26 vulnerabilities, 24 of which were confirmed by the respective vendors, and 9 were assigned CVEs.

One particularly significant finding was a token-starvation vulnerability in the MS/TP protocol itself: a device that continuously sends messages can effectively freeze all other devices on the bus, as they will remain silent waiting for the token. This was acknowledged by the ASHRAE BACnet community as a protocol-level flaw, not just an implementation bug.

Technical Deep Dive

▶ Watch: Using LLMs to extract message structures from BACnet specification (10:00)

BACFuzz consists of three components: LLM-assisted mutation policy, throughput optimization, and consistency verification.

LLM-Assisted Specification Parsing: The researchers fed the BACnet specification text into ChatGPT to automatically extract message structures, identify individual fields, and classify each field as fully defined, explicitly reserved, or implicitly reserved. The LLM achieved 100% accuracy on structure extraction and message structure expression, 100% on field length extraction, over 95% on field value extraction, and approximately 96% on implicitly reserved field identification. This automation was critical because manually parsing the poorly written BACnet specification would be prohibitively labor-intensive. The students fine-tuned the prompts extensively to achieve these accuracy levels.

Throughput Optimization via Token-Starvation: The key insight for fuzzing throughput was to exploit the MS/TP token-passing mechanism itself. By modifying the underlying state machine code of the fuzzer's MS/TP implementation, the researchers bypassed the token-passing protocol entirely. Their fuzzer continuously sends messages without waiting for the token, which causes all other devices on the bus to remain silent. This effectively gives the fuzzer exclusive use of the bus when targeting a specific device, eliminating the overhead of token management. The result is a 700% throughput improvement over the baseline approach, and the throughput remains constant regardless of how many other devices are on the test bed -- whereas conventional approaches see severe degradation with each additional device.

Consistency Verification: Beyond detecting crashes (no-response conditions), BACFuzz verifies whether device responses comply with the BACnet specification. Error codes defined in the specification are extracted and used to generate test cases that should trigger specific error responses. If a device responds differently than the specification dictates, or fails to respond to conditions that should produce defined error codes, these deviations are flagged as specification compliance violations. For implicitly reserved fields specifically, the fuzzer injects unexpected values and monitors for crashes, hangs, or specification-violating responses.

Compared to generic fuzzing frameworks like AFL and AFLNet adapted for BACnet, BACFuzz found all vulnerabilities within half a day, while the generic frameworks could not find all vulnerabilities even with extended runtime, because they mutate all fields rather than targeting the error-prone implicitly reserved fields.

Demo / Proof of Concept

▶ Watch: Token-starvation: bypassing token passing for 700% throughput boost (14:00)

The evaluation tested 20 BACnet devices from 9 vendors in a physical test bed. Siemens devices were most extensively tested (7 devices, 11 vulnerabilities found). One vendor requested anonymity (4 devices, 4 vulnerabilities). The token-starvation throughput optimization was validated by measuring throughput as devices were added to the test bed: the baseline approach saw significant throughput degradation with each added device, while BACFuzz maintained constant throughput. All 26 vulnerabilities were found in implicitly reserved fields, and the researchers note that even weeks after publication, newly discovered vulnerabilities continue to occur in these same fields. The LLM-assisted specification parsing was validated against manual analysis, with near-perfect accuracy across all extraction tasks and no false positives in the final results after prompt fine-tuning.

Defensive Implications

▶ Watch: 100% of errors in implicitly reserved fields -- a remarkable pattern (20:00)

For building operators and facility managers, this research reveals that the BAS devices controlling your building infrastructure likely contain exploitable vulnerabilities. The fact that 19 out of 20 tested devices (from major vendors) had vulnerabilities suggests this is a systemic problem across the industry, not isolated to specific manufacturers.

For BAS vendors and the ASHRAE BACnet committee, the finding that all vulnerabilities cluster in implicitly reserved fields points to a concrete specification improvement: every field should either fully define all possible values or explicitly mark undefined values as reserved with specified error handling. The protocol-level token-starvation flaw also demands a specification-level fix, as no individual device implementation can mitigate a protocol design weakness.

For security teams conducting BAS assessments, BACFuzz demonstrates that targeted fuzzing of implicitly reserved fields is dramatically more efficient than generic fuzzing. The LLM-assisted specification parsing approach could be adapted to other poorly documented industrial protocols. The 700% throughput improvement through token-starvation makes BACnet fuzzing practically feasible for the first time.

For red teams and penetration testers, the token-starvation technique itself is a denial-of-service vector: any device on an MS/TP bus that continuously transmits can freeze all other devices, potentially disrupting HVAC, lighting, and access control systems in a building. This is a protocol-level weakness that cannot be mitigated without specification changes.

Key Takeaways

• BACnet, with 70% market share in building automation, has severe implementation security issues across major vendors
• 100% of discovered vulnerabilities occurred in implicitly reserved fields -- protocol fields where undefined values are silently ignored by the specification
• LLM-assisted specification parsing achieved near-100% accuracy in extracting message structures and identifying error-prone fields from BACnet's poorly written specification
• Bypassing the MS/TP token-passing mechanism provides a 700% fuzzing throughput improvement and reveals a protocol-level denial-of-service flaw
• 26 vulnerabilities across 20 devices from 9 vendors; 24 confirmed, 9 CVEs assigned
• The token-starvation vulnerability was acknowledged as a protocol-level flaw by the ASHRAE BACnet community
• The approach generalizes to other industrial protocols with similar specification quality issues

About the Speaker(s)

Qiguang Zhang is the listed speaker, with the talk presented by Shan Fu, a professor at Loughborough University, on behalf of students who could not attend. The research is a collaboration between Loughborough University, Southeast University, Shantou University, and Fuhua University of Science and Technology. The team has prior work on BAS security and has demonstrated expertise in industrial protocol analysis, fuzzing, and LLM-assisted security testing.