Recent research by Claroty has highlighted a significant security gap in critical infrastructure: approximately one in five cyber-physical systems (CPS) within major data center facilities are readily accessible to remote attackers. According to SecurityWeek, an analysis of 750,000 CPS assets across global data centers revealed that 20% of these critical components are either directly connected to the internet or reside on poorly segmented networks. This exposure represents a substantial CVE risk landscape, as many of these legacy systems were never designed with modern security protocols in mind.
The assets in question primarily include Building Management Systems (BMS), Electrical Power Monitoring Systems (EPMS), Uninterruptible Power Supplies (UPS), and Power Distribution Units (PDU). While these systems are essential for maintaining the uptime and environmental conditions of a data center, their compromise could lead to catastrophic physical outcomes, including equipment failure or intentional service disruption. Because these systems often run on proprietary or legacy hardware, they lack the native security features found in modern IT stacks.
Securing Data Center Cyber-Physical Systems against Remote Exploitation
The primary challenge in securing data center cyber-physical systems lies in the convergence of Information Technology (IT) and Operational Technology (OT). Traditionally, OT systems operated in air-gapped environments. However, the demand for remote monitoring and real-time telemetry has pushed these systems onto IP-based networks. When these systems are not protected by a Zero Trust architecture, they become low-hanging fruit for threat actors seeking to disrupt operations.
Claroty’s research indicates that the exposure is not merely theoretical. Attackers can leverage simple search tools to find exposed industrial controllers. Once access is gained to a BMS or HVAC system, a sophisticated APT could perform Lateral Movement to reach more sensitive parts of the infrastructure, such as management consoles or even the server hardware itself. The lack of EDR capabilities on these specialized devices makes detection significantly harder for a standard SOC. This visibility gap means an intruder could persist within the cooling or power systems for extended periods without detection.
How to Identify Exposed Data Center Assets and Vulnerabilities
Organizations must adopt a proactive stance by performing regular external scans to see what an attacker sees. Identifying exposed data center assets requires a combination of network discovery tools and specialized industrial protocol analyzers. Many of the vulnerabilities found in these environments are not related to a specific CVE but rather to configuration errors, such as the use of default credentials or unencrypted communication protocols like Modbus or BACnet. These protocols often lack authentication, allowing anyone who can reach the IP address to send commands to the hardware.
Furthermore, the presence of Ransomware in data center environments is no longer limited to the software layer. An attacker could theoretically hold the physical environment of the data center hostage by manipulating cooling systems (HVAC) to induce thermal shutdowns. This type of physical DDoS attack can be just as damaging as a traditional network-based assault, as it forces the physical shutdown of servers to prevent hardware melting, leading to massive service outages.
Actionable Recommendations for Infrastructure Defenders
To mitigate these risks, defenders must prioritize the following strategies:
- Strict Network Segmentation: Ensure that all OT and CPS traffic is isolated from the corporate IT network and the public internet. Use industrial firewalls to enforce granular access control lists.
- Disable Insecure Protocols: Where possible, transition away from clear-text industrial protocols and implement encrypted alternatives or secure gateways.
- Continuous Monitoring: Integrate OT-specific security tools with existing SIEM platforms to gain visibility into anomalous traffic patterns within the BMS and EPMS layers.
- Credential Hygiene: Audit all CPS devices for default or weak credentials and enforce strong, unique passwords, ideally managed through a centralized identity platform.
By addressing these foundational gaps, organizations can significantly reduce the TTP options available to attackers and ensure the physical resilience of their digital operations against both opportunistic and targeted threats.
Related: OT Security: Legacy System Vulnerabilities in Critical Infrastructure, CVE-2026-4293: Kieback & Peter DDC XSS — Mitigate Building Controller Risks