ZoomEye finds 48,667 exposed BACnet devices on UDP 47808

A ZoomEye scan returned 48,667 hosts with BACnet/IP port 47808 open — a building automation protocol that answers broadcast queries without authentication. The real population is larger, since most deployments sit behind routers that do not forward the broadcast domain.

• Port 47808 (0xBAC0) is the registered UDP port for BACnet/IP
• The base protocol requires no authentication for Who-Is and I-Am
• ReadProperty exposes device objects, schedules and trend logs
• WriteProperty can alter setpoints on fans and valves