Port 47808 – BACnet/IP (Building Automation and Control Network)

Port 47808 (0xBAC0 in hex — the “BAC” is deliberate) is the default UDP port for BACnet/IP, the Building Automation and Control Network protocol that ties together the operational systems of a modern building. It is the dominant language of building management systems (BMS) and building automation systems (BAS): HVAC controllers, VAV boxes, chillers and boilers, lighting panels, damper and valve actuators, energy meters, access control, and elevator controllers all speak BACnet to a supervisory front end. On the wire, BACnet/IP wraps its messages in a BACnet Virtual Link Control (BVLC) header and sends them over UDP 47808, using broadcast Who-Is/I-Am for discovery and ReadProperty/WriteProperty for data. The crucial fact for a pentester: the base BACnet standard has no authentication and no encryption, so anything that can reach an open 47808 can enumerate and — in most deployments — change the objects that run the building.

Why It’s Open

Port 47808 is open because a building has controls, and those controls need to talk to each other and to a supervisory workstation. BACnet/IP is the default transport for that traffic, so any site with a BMS/BAS front end (Tridium Niagara, Schneider EcoStruxure/Andover, Siemens Desigo, Johnson Controls Metasys, Honeywell, Delta, Reliable, KMC, and dozens of controller vendors) has BACnet/IP devices listening on 47808.

Trouble starts when that control network is not properly segmented from the corporate LAN or, worse, is reachable from the internet. BACnet was designed for a trusted, physically-isolated building network — but controllers get plugged into shared switches, routed to remote sites, or exposed through misconfigured firewalls and BACnet Broadcast Management Devices (BBMDs) that forward broadcast traffic across subnets. Tens of thousands of BACnet devices are indexed by Shodan on 47808, and each one answers discovery queries from anyone who asks. There is no login to fail.

Common Risks

• No authentication or encryption by design. The base BACnet standard has neither. Reaching 47808 is the entire barrier — there is no credential to guess, so an attacker who can route a packet to the device is already “in.”
• Unauthenticated discovery. A broadcast Who-Is makes every controller reply with I-Am, disclosing device instance number, vendor ID, model name, firmware revision, and network address — a full inventory of the building’s controls for free.
• Reading live building state. ReadProperty/ReadPropertyMultiple returns object values: temperatures, setpoints, occupancy, run states, alarm thresholds, schedules, and the whole object list of a device. This is reconnaissance and privacy exposure in one.
• Writing building state — the real impact. WriteProperty/WritePropertyMultiple lets an unauthenticated attacker change values: override a temperature setpoint, drive a damper or valve to an extreme, disable a schedule, silence or trip alarms, or flip a binary output. On many controllers writes are accepted with no restriction beyond the BACnet priority array.
• Denial of service against controllers. Embedded BACnet stacks are memory-constrained C code; malformed APDUs have repeatedly crashed the daemon (see CVEs below). A crashed controller can mean a stuck HVAC plant or a dropped supervisory link.
• Vendor management-plane flaws. The BMS controllers behind 47808 usually also run a web/SSH/proprietary management interface, and those have carried critical bugs (backdoors, auth bypass, RCE) that hand over the whole device.
• Reflection/broadcast abuse. Being UDP and broadcast-heavy, BACnet/IP and BBMD forwarding can be abused for traffic amplification and network-wide noise.

Want to save time on reporting?

Let PentestPad generate, track, and export your reports - automatically.

Book a Demo

Enumeration & Testing

Treat 47808 as an unauthenticated, read/write control interface. Confirm it, enumerate devices, read a few objects, and — only in an authorised engagement, and carefully — demonstrate that writes are accepted. Never write to production building controls without explicit scope and change control; a bad WriteProperty can move real physical equipment.

Confirm the service and version

nmap -sU -sV -p 47808 <target>

Discover and enumerate BACnet devices (Digital Bond Redpoint NSE)

The BACnet-discover-enumerate.nse script is part of Digital Bond’s Redpoint project (not shipped with core Nmap — drop it into your Nmap scripts directory first). It identifies BACnet devices and reads key properties.

nmap -sU -p 47808 --script BACnet-discover-enumerate <target>

Metasploit BACnet scanner

The framework ships a verified BACnet module that broadcasts Who-Is and polls responders for model name, firmware, and description.

msfconsole -q
use auxiliary/scanner/scada/bacnet_l3
set RHOSTS <target>
run

BACnet Stack command-line utilities (bacwi / bacrp / bacwp)

The open-source bacnet-stack project ships small demo tools that map directly to BACnet services — discovery, read, and (the dangerous one) write.

# Broadcast Who-Is and print every I-Am reply (device instance, vendor, max APDU, segmentation)
bacwi -1

# ReadProperty: read a single property from a device
bacrp <device-instance> <object-type> <object-instance> <property-id>

# WriteProperty: change a property value — demonstrate only in-scope, with change control
bacwp <device-instance> <object-type> <object-instance> <property-id> <priority> <tag> <value>

BACpypes (Python) for scripted interaction

# BACpypes sample consoles — discovery and reads
python WhoIsIAm.py
python ReadProperty.py

Watch the traffic in Wireshark / tshark

Wireshark’s BACnet dissectors (bvlc for the link layer, bacapp for the application APDUs) decode every field.

tshark -i eth0 -f "udp port 47808" -Y "bvlc || bacapp"

Record every device instance, object list, and any property you can read or write, so the inventory and the proof-of-write land in the pentest report instead of a scratch terminal you will lose.

What to Look For

Known CVEs and Exploits

The honest headline for port 47808 is that its biggest weakness is not a CVE at all — it is the design decision that base BACnet has no authentication or encryption, so WriteProperty abuse works “as intended” against most exposed controllers. That said, real memory-safety bugs exist in the common open-source stack, and the BMS controllers that speak BACnet have carried critical management-plane flaws. Every CVE below was verified against its NVD record and scoped to a genuine BACnet product; wrong-service SCADA CVEs (e.g. the Phoenix Contact switch and Geovap SCADA advisories that get loosely tagged “building automation”) were deliberately left out.

• CVE-2026-41475 — Out-of-bounds read in the WritePropertyMultiple service decoder of BACnet Stack 1.4.0–1.4.2. An unauthenticated, truncated WPM request makes the deprecated decode_tag_number_and_value() read 1–7 bytes past the buffer, crashing the device or leaking memory. CVSS 9.1 (Critical). Fixed in 1.4.3.
• CVE-2026-41502 — Off-by-one out-of-bounds read in the ReadPropertyMultiple decoder of BACnet Stack (1.4.0 through 1.4.2). A crafted RPM request with a truncated object identifier reads one byte past an allocated buffer in rpm_decode_object_id(), causing a remote DoS. Affects the default configuration (RPM enabled). CVSS 7.5 (High).
• CVE-2019-12480 — Denial of service in the BACnet Stack APDU layer through 0.8.6. A malformed DeviceCommunicationControl (also reachable via AtomicWriteFile/AtomicReadFile) triggers a segmentation fault in bacdcode.c, crashing the bacserv daemon without authentication. CVSS 7.5 (High), CWE-125.
• CVE-2019-7276 — Not a BACnet-protocol bug but a vivid reminder of what sits behind 47808: Optergy Proton/Enterprise building management systems (≤2.3.0a) shipped a backdoor console allowing unauthenticated remote root code execution. CVSS 9.8 (Critical). The lesson: the controller’s management plane is often the softer target once you have identified the device via BACnet.

No fabricated “port 47808 RCE” is claimed here. Against a fully-patched stack the durable risk remains the protocol’s lack of authentication — so scope your engagement around unauthorised reads and writes, not just CVE matching.

Mitigation

• Segment the control network. BACnet assumes a trusted, isolated fabric — give it one. Put BMS/BAS devices on a dedicated VLAN with no route to the corporate LAN or the internet, and never let 47808 reach an untrusted interface.
• Firewall UDP 47808 to the specific supervisory hosts and controllers that must communicate, and lock down BBMD forwarding so broadcasts do not leak across subnets.
• Adopt BACnet/SC where you can. BACnet/SC (Secure Connect) is the newer, TLS-based addition that finally brings authentication and encryption to BACnet — it is still rarely deployed, but it is the standards-based fix for the no-auth problem. Where BACnet/SC is not an option, tunnel BACnet/IP over a VPN or IPsec between sites rather than exposing it.
• Patch the stack and the controller. Keep bacnet-stack and vendor firmware current to close the DoS and management-plane bugs above, and harden or disable the device’s web/SSH admin interface.
• Restrict writes. Where the controller supports it, disable or restrict WriteProperty from untrusted sources, use the priority array and out-of-service flags deliberately, and monitor for unexpected value changes.
• Monitor 47808. Alert on Who-Is sweeps, unexpected WriteProperty traffic, and any BACnet packets crossing a segmentation boundary — and confirm exposure the way an attacker would, by checking Shodan for your own address space.

Real-World Example

The canonical BACnet attack needs no exploit code — just reachability. An attacker searches Shodan for BACnet devices (tens of thousands sit on 47808), picks one that is routable, and sends a broadcast Who-Is. Every controller on the segment answers I-Am, revealing its device instance, vendor, model, and firmware. A follow-up ReadProperty/ReadPropertyMultiple pulls the object list and live values — supply-air temperatures, occupancy schedules, setpoints, alarm limits. Because the base standard authenticates none of this, the same session can then issue WriteProperty to override a setpoint, drive a damper or valve, disable a schedule, or trip an alarm — physically affecting the building with no password ever entered. Security researchers have demonstrated exactly this against internet-exposed HVAC and BMS controllers for over a decade (the Digital Bond Redpoint tooling and repeated conference talks on “hacking buildings” all lean on this Who-Is → ReadProperty → WriteProperty chain), and the CVE-2019-7276 Optergy backdoor showed how the controller’s management plane compounds the problem once the device is found. The port number is mundane; the fact that reaching it equals controlling the building is the finding.

FAQ

What is port 47808 used for?

Port 47808 (0xBAC0) is the default UDP port for BACnet/IP, the protocol that networks building automation devices — HVAC, lighting, boilers, chillers, access control, elevators, and energy meters — inside a building management system (BMS/BAS). Controllers use it to discover each other (Who-Is/I-Am) and to exchange data (ReadProperty/WriteProperty).

Is port 47808 dangerous to expose?

Yes. The base BACnet standard has no authentication and no encryption, so anyone who can reach an open 47808 can enumerate controllers and, on most deployments, read and change building values with no credentials. BACnet was meant for an isolated control network; exposing it to the corporate LAN or the internet effectively hands over control of the building’s systems.

Can an attacker really change building settings over BACnet?

Often, yes. WriteProperty/WritePropertyMultiple can set object values — temperature setpoints, schedules, damper/valve positions, alarm thresholds, binary outputs — and many controllers accept those writes without authentication. That is why an exposed 47808 is treated as an unauthenticated control interface, not just an information leak.

What is BACnet/SC and does it fix this?

BACnet/SC (Secure Connect) is a newer datalink option added to the BACnet standard that runs over TLS and finally provides authentication and encryption. It is the standards-based fix for BACnet’s no-auth problem, but it is still rarely deployed in the field, so most live installations remain the classic unauthenticated BACnet/IP on UDP 47808.

How do I find and test what is running on port 47808?

Confirm the service with nmap -sU -sV -p 47808 <host>, enumerate devices with Digital Bond’s BACnet-discover-enumerate NSE or Metasploit’s auxiliary/scanner/scada/bacnet_l3, and read/write properties with the bacnet-stack tools (bacwi, bacrp, bacwp) or BACpypes. Only demonstrate writes with explicit authorisation and change control, since they move real equipment.

How do I secure port 47808?

Segment BACnet onto an isolated VLAN with no internet route, firewall UDP 47808 to only the hosts that need it, lock down BBMD broadcast forwarding, adopt BACnet/SC or tunnel BACnet over a VPN between sites, patch the stack and controller firmware, restrict WriteProperty where supported, and monitor for discovery sweeps and unexpected writes.

TL;DR

• Service: BACnet/IP — the dominant building automation / BMS protocol for HVAC, lighting, access control, and more (47808 = 0xBAC0)
• Default port: 47808/UDP (BACnet/IP over a BVLC header; broadcast Who-Is/I-Am discovery)
• Biggest risk: no authentication or encryption in the base standard — reachable 47808 lets an attacker enumerate controllers and use WriteProperty to change setpoints, schedules, and outputs with no credentials; stack DoS bugs and vendor management-plane RCE (e.g. Optergy backdoor) compound it
• Mitigation: isolate the control VLAN, firewall UDP 47808, lock down BBMD forwarding, move to BACnet/SC or a VPN, patch the stack/firmware, restrict writes, and monitor — capture the device inventory and any proof-of-write in your pentest report

Related ICS/building and discovery ports worth checking on the same engagement: port 502 (Modbus), Siemens S7comm on port 102, EtherNet/IP on port 44818, port 161 (SNMP), and port 1900 (SSDP device discovery).