KNX visualisering - Broken Access Control

ExploitDBExploitDB exploitWriteupEDB-52613

PoC files

1 file

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

ExploitDB
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a technical writeup describing a broken access control vulnerability in KNX visualisering. It explains how to find exposed panels using search engines, notes the lack of rate limiting on the PIN panel, and provides an example of brute-forcing a 6-digit PIN using Burp Suite. It does not contain executable exploit code or a scanner; it is a narrative description of the vulnerability and manual exploitation steps.

Backdoor review

No backdoor observed in reviewed code

The supplied text describes a broken access control vulnerability in KNX visualisering, including dork queries, a brute-force PIN attack, and an example HTTP request/response. No backdoor, deceptive payload, or concealed executable behavior is present in the reviewed evidence.

ClassificationWriteup
Model confidence95%
AuthenticationNot required
LanguagesEnglish
Target softwareKNX visualisering
Attack typesBroken Access ControlBrute Force
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a text file describing a vulnerability and manual exploitation steps. It contains no executable code, no automated scanning script, and no proof-of-concept code. It is a narrative writeup with an example HTTP request/response, which is typical of a vulnerability disclosure or technical writeup.

exploits/multiple/webapps/52613.txt:1-73

Requirements

  • Attacker must locate a KNX visualisering panel, e.g., using Shodan, ZoomEye, or Fofa dorks.exploits/multiple/webapps/52613.txt:8-14
  • The target panel must lack rate limiting on the PIN entry endpoint.exploits/multiple/webapps/52613.txt:17

Observed behavior

  • The author describes using search engine dorks to find KNX visualisering panels.exploits/multiple/webapps/52613.txt:8-14
  • The author notes that the PIN panel lacks rate limiting, allowing brute force attacks.exploits/multiple/webapps/52613.txt:17
  • The author provides an example HTTP request and response showing a successful PIN brute force (PIN 200908) on a specific IP.exploits/multiple/webapps/52613.txt:25-65
  • The author lists two example IPs of panels that are accessible without authentication.exploits/multiple/webapps/52613.txt:69-73
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Ip Address
62.163.74.206Example target IP used in the PoC description.exploits/multiple/webapps/52613.txt:25
Url
https://85.147.34.42/scada-visExample of a panel without authentication mentioned in the PoC.exploits/multiple/webapps/52613.txt:71
Url
https://185.72.160.230/scada-visExample of a panel without authentication mentioned in the PoC.exploits/multiple/webapps/52613.txt:73
Review boundaries

What the analysis did not establish

  • The artifact is a single text file; no external tools, libraries, or referenced resources are included.
  • The provided HTTP request/response is an example, not an executable script or automated scanner.
  • Only the supplied text file was reviewed; no external resources, binaries, or network content were analyzed.
  • The artifact describes a vulnerability and example targets, but does not contain executable code or instructions that would directly harm the reviewer.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

0

This PoC is retained in the catalog but is not currently linked to a vulnerability.