# Black Hat Europe 2025: Was that device designed to be on the internet at all?

DevFeed: [Black Hat Europe 2025: Was that device designed to be on the internet at all?](<https://devfeed.tech/articles/black-hat-europe-2025-was-that-device-designed-to-be-on-the-internet-at-all-8385.md>)

Original publisher: [Read original article](<https://www.welivesecurity.com/en/internet-of-things/black-hat-europe-2025-device-designed-internet/>)

Author: Tony Anscombe

Published: 2025-12-12T15:22:52Z

Content type: article

Language: en

Sources: [WeLiveSecurity](<https://devfeed.tech/sources/welivesecurity.md>)

Topics: [Vulnerabilities](<https://devfeed.tech/topics/vulnerabilities.md>), [Critical Infrastructure](<https://devfeed.tech/topics/critical-infrastructure.md>), [Security](<https://devfeed.tech/topics/security.md>), [Software](<https://devfeed.tech/topics/software.md>), [Virtual Private Network](<https://devfeed.tech/topics/vpn.md>), [Internet](<https://devfeed.tech/topics/internet.md>), [.env](<https://devfeed.tech/topics/dotenv.md>)

Tags: [2025](<https://devfeed.tech/tags/2025.md>), [black-hat](<https://devfeed.tech/tags/black-hat.md>), [business-security](<https://devfeed.tech/tags/business-security.md>), [critical-infrastructure](<https://devfeed.tech/tags/critical-infrastructure.md>), [europe](<https://devfeed.tech/tags/europe.md>), [firmware](<https://devfeed.tech/tags/firmware.md>), [internet](<https://devfeed.tech/tags/internet.md>), [security](<https://devfeed.tech/tags/security.md>), [vpn](<https://devfeed.tech/tags/vpn.md>), [vulnerabilities](<https://devfeed.tech/tags/vulnerabilities.md>)

## AI overview

The article examines a building management system used in more than 1,000 buildings that contains extensive vulnerabilities and is exposed through public-facing internet connections. It attributes the weaknesses to legacy firmware, acquisitions, insufficient security auditing, and incomplete remediation, and argues that organizations should perform full code audits and address root causes after vulnerability disclosures. It also warns that systems not designed for internet exposure should be protected behind a VPN, particularly when they support critical infrastructure.

## Source excerpt

Behind the polished exterior of many modern buildings sit outdated systems with vulnerabilities waiting to be found