Note: this scope includes private, lab or documentation ranges. This is a lab / test report, not a production assessment.
5 exposed OT / building system(s): 3 critical, 2 high, 0 medium, 0 low.
Sources checked: examples/shodan.example.json (import, 8 observations).
Observations: 8 received, 8 after cross-source dedupe: 6 in scope, 1 out of scope (excluded, appendix), 1 honeypot suspects (excluded, appendix), 1 in-scope IT-only services.
| # | Severity | Exposure | System | Product | Impact | Fix | Confidence / basis | CVEs flagged | Evidence (banner) | Source |
|---|---|---|---|---|---|---|---|---|---|---|
| 1 | CRITICAL | BACnet/IP 203.0.113.10:47808/udp |
cooling | BACnet Stack 1.0 | Building controller for cooling / HVAC. BACnet has no authentication in its classic form: anyone who can reach it can read points and, on many devices, write setpoints. Loss or manipulation of cooling can force thermal shutdowns within minutes at modern densities. | Remove BACnet/IP from the public internet. Place it behind the BMS VPN / jump host, or migrate to BACnet/SC with certificates. Firewall UDP 47808 to named management addresses only. | high protocol confirmed by banner / product data |
none flagged | BACnet/IP device instance 1234, vendor ExampleControls | shodan observed 2026-10-27T12:00:00.000000 |
| 2 | CRITICAL | Modbus TCP 203.0.113.11:502/tcp |
power | Modbus TCP | Modbus has no authentication or encryption. In a data center it commonly fronts UPS units, PDUs, meters and generator controllers: read and write access to power equipment registers. Loss or manipulation of power distribution, UPS or generation can drop the load the facility exists to carry. | Remove Modbus TCP from the public internet immediately. Put power devices on a segmented OT VLAN reachable only from the DCIM / BMS network, through a jump host. | high protocol confirmed by banner / product data |
none flagged | Modbus device: UPS controller unit id 1 | shodan observed 2026-10-27T12:00:00.000000 |
| 3 | CRITICAL | Niagara Fox 203.0.113.12:1911/tcp |
control | Niagara Fox 4.10 | Tridium Niagara station protocol. A reachable Fox service exposes the building automation station that supervises cooling, power and alarms for the facility. This is a supervisory control system: compromise here can reach the cooling and power systems it supervises. | Remove Fox from the public internet. Access Niagara stations only through the vendor VPN / secure remote access with MFA. Disable Fox where FoxS or Niagara Web is used instead. | high protocol confirmed by banner / product data |
CVE-2020-0000 | fox version 4.10 station ExampleStation | shodan observed 2026-10-27T12:00:00.000000 |
| 4 | HIGH | SNMP 203.0.113.13:161/udp |
monitoring | APC UPS SNMP | Monitoring protocol for UPS, PDU, cooling and generator equipment. SNMP v1/v2c uses guessable community strings and leaks device model, firmware and load data useful for planning an attack. Monitoring exposure blinds operators and leaks the data an attacker needs to plan a physical attack. | Block SNMP at the perimeter. Use SNMPv3 with authentication inside the management network only; change every default community string (public / private). | high protocol confirmed by banner / product data |
none flagged | SNMP public community, model Smart-UPS, firmware 4.1 | shodan observed 2026-10-27T12:00:00.000000 |
| 5 | HIGH | BMS web management 203.0.113.14:443/tcp |
control | Automated Logic WebCTRL | Web management for a building system (webctrl) reachable from the internet. This is a supervisory control system: compromise here can reach the cooling and power systems it supervises. | Remove building-system web management from the public internet. Require VPN with MFA for vendor and operator access; keep the BMS application patched. | high building-system product "webctrl" identified in service data |
none flagged | WebCTRL building automation login | shodan observed 2026-10-27T12:00:00.000000 |
#1 NIST CSF 2.0: PR.IR-01, PR.AA-03, PR.AA-05, ID.RA-01 (Network protection (PR.IR), authentication and access control (PR.AA), risk assessment (ID.RA))
Insurance relevance: Building automation / HVAC controls reachable from the public internet; remote vendor access without MFA
#2 NIST CSF 2.0: PR.IR-01, PR.AA-03, PR.AA-05, ID.RA-01 (Network protection (PR.IR), authentication and access control (PR.AA), risk assessment (ID.RA))
Insurance relevance: Power infrastructure (UPS, PDU, generator) controls reachable from the public internet; network segmentation of OT
#3 NIST CSF 2.0: PR.IR-01, PR.AA-03, PR.AA-05, PR.DS-02, ID.RA-01 (Network protection (PR.IR), authentication and access control (PR.AA), data security (PR.DS), risk assessment (ID.RA))
Insurance relevance: Supervisory / building management system exposed to the internet; MFA for remote access; vendor remote-access controls
#4 NIST CSF 2.0: PR.IR-01, PR.AA-03, PR.DS-02, DE.CM-01 (Network protection (PR.IR), authentication (PR.AA), data security (PR.DS), continuous monitoring (DE.CM))
Insurance relevance: SNMP v1/v2c with default or guessable community strings (public / private) on infrastructure devices
#5 NIST CSF 2.0: PR.IR-01, PR.AA-03, PR.AA-05, PR.DS-02, ID.RA-01 (Network protection (PR.IR), authentication and access control (PR.AA), data security (PR.DS), risk assessment (ID.RA))
Insurance relevance: Supervisory / building management system exposed to the internet; MFA for remote access; vendor remote-access controls
This view maps findings to framework categories and common questionnaire topics. It is not a certification or an audit opinion.
Out of scope (1): 198.51.100.9:47808/udp. These were never treated as findings about this facility.
Honeypot suspects (1): 203.0.113.99:47808/udp.
Report integrity: SHA-256 6325ad6cfbae8cd8b673a64030981f1843dc5407a607245d26f7523e9209e012
ATLAS-OT v1.1.3 - BANGRE NOOMA DIGITAL TECHNOLOGY LLC. This assessment does not guarantee that a facility has no exposure, and does not operate or remediate building systems.