Critical Vulnerabilities in Building Management Systems Expose Infrastructure to Cyberattacks Research from Claroty’s Team82 reveals that the widespread adoption of the CEA-852 standard which enables legacy protocols like LonTalk to operate over IP networks has significantly expanded the attack surface for building management systems (BMS). While this shift enhances flexibility and interoperability, it also introduces severe cybersecurity risks, including unauthorized access, traffic manipulation, and remote exploitation when security controls are weak or absent. The findings, detailed in The Risky Road Bringing Building Management Systems Online, highlight systemic vulnerabilities in smart buildings. Three-quarters of organizations using BMS are affected by known exploited vulnerabilities, with over half exposing these systems to the internet often linked to ransomware attacks. Since BMS control critical functions like HVAC, energy, and physical security, their compromise could disrupt operations or serve as a gateway for deeper infiltration into enterprise and critical infrastructure networks. ### Key Vulnerabilities in CEA-852 Implementations The CEA-852 standard supports three variants IP-852, RNI, and LPA each differing in packet types, payload formats, and HMAC signing algorithms. While RNI and LPA share similarities, IP-852 stands apart with distinct packet structures and authentication methods. - IP-852 packets (protocol code 0x01) include standard (vendor-neutral) and proprietary (vendor-specific) types. Standard packets handle core functions like LonTalk encapsulation and device queries, while proprietary packets used by vendors like Echelon (0x01) and Loytec (0x02) enable advanced features such as remote reboots, firmware updates, and NAT configuration. - HMAC authentication, based on MD5 and a 16-byte pre-shared key, is used to verify packet integrity. However, many devices disable HMAC entirely or use default keys (e.g., all-zero values), making it trivial for attackers to forge valid messages. ### Exploitable Weaknesses in RNI/LPA and Loytec Devices - RNI (0x03) and LPA (0x04) packets share identical structures but differ in response handling. Analysis of compiled libraries (e.g., libRNI.so, libLSPA.so) revealed that KEEP_ALIVE packets (type 0x00) enforce payload constraints, rejecting malformed or manipulated messages. - HMAC recovery is possible via offline brute-force attacks using a single captured packet, even without direct interaction with the target. - Loytec-specific packets (vendor code 0x02) contain unauthenticated reboot commands (type 0x90), allowing attackers to trigger denial-of-service (DoS) conditions by forcing controller restarts. Additionally, researchers identified methods to bypass internal security mechanisms, enabling unauthorized modification of core device configurations. ### Real-World Impact The research underscores that insecure BMS deployments are already widespread, with many devices publicly exposed and lacking basic protections. Attackers could exploit these flaws to disrupt building operations, manipulate environmental controls, or pivot into broader network infrastructure posing risks to hospitals, data centers, and industrial facilities. Claroty’s findings serve as a critical warning: as legacy BMS protocols transition to IP-based networks, organizations must address design weaknesses, enforce HMAC authentication, and restrict internet exposure to mitigate escalating cyber threats.