| Name | Modified | Size | Downloads / Week |
|---|---|---|---|
| Parent folder | |||
| latest.json | 2026-11-07 | 423 Bytes | |
| HVACNetworkScanner.exe.sha256 | 2026-11-07 | 88 Bytes | |
| HVACNetworkScanner.exe | 2026-11-07 | 13.2 MB | |
| README.md | 2026-11-07 | 3.1 kB | |
| v2.12.0 source code.tar.gz | 2026-11-07 | 646.8 kB | |
| v2.12.0 source code.zip | 2026-11-07 | 700.2 kB | |
| Totals: 6 Items | 14.6 MB | 0 | |
The survey report now says which controllers run firmware covered by a published security advisory, and what version to update to. Full details are in CHANGELOG.md (github.com). The project's website is jamesccupps.github.io/HVAC-Network-Scanner.
Already on 2.10 or 2.11? Press Update to 2.12.0 in the header, or wait for the daily check. Older copies need this download once.
Download
HVACNetworkScanner.exe is the GUI as one file; no Python needed. It was built by GitHub Actions from the v2.12.0 tag (build log), with PyInstaller and its dependencies pinned by hash.
SHA-256 A50953F88E4E8F94986CF4810D1706EB9A560F812B3B4F5622A686F89395B4A3
Check it before running. The same hash is in HVACNetworkScanner.exe.sha256:
:::powershell
Get-FileHash .\HVACNetworkScanner.exe -Algorithm SHA256
The build signs an attestation that this exact file came from that workflow run and commit. To verify it with the GitHub CLI:
:::powershell
gh attestation verify .\HVACNetworkScanner.exe --repo jamesccupps/HVAC-Network-Scanner
The executable is not code-signed, so Windows SmartScreen will say "Windows protected your PC". Once the hash matches, use More info → Run anyway. If Windows Firewall asks, allow it on the networks you scan, or BACnet replies to a broadcast will be dropped.
Firmware covered by published advisories
The report checks the firmware each BACnet controller reports about itself against CISA ICS advisories, taken from CISA's own CSAF data.
| Product | Advisories | Update to |
|---|---|---|
| Trane Tracer SC+ | ICSA-26-071-01 | v6.30.2313 |
| Trane Tracer SC | ICSA-26-071-01 | check by hand (affected before v4.4_SP7) |
| Siemens APOGEE PXC Modular / Compact (BACnet firmware) | ICSA-22-349-16 | 3.5.5 |
| ICSA-22-286-12, ICSA-26-295-08 | 3.5.7 | |
| ICSA-25-044-11, ICSA-25-135-14, ICSA-25-254-05 | no fix yet; mitigations in the advisories | |
| Siemens Desigo DXR2 | ICSA-22-132-10 | 01.21.142.5 |
| ICSA-26-225-08 | 01.21.233.16 | |
| Siemens Desigo PXC4 / PXC5 / PXC7 | ICSA-26-225-08 | 02.21.194.36 |
| Siemens Desigo CC | ICSA-26-209-01 | check the installed release (V9 before QU1) |
- To update. Devices older than an advisory's fix are listed under Firmware covered by published security advisories. They are grouped by model and reported version, with each advisory ID and the version to update to. The finding is rated high when an advisory scores 7 or more.
- To check. Some devices report a version too short to place. For example, a DXR2 saying "v01.21" can't be compared with a fix at 01.21.142.5. Those are listed under Firmware to check against published advisories, so they can be checked on the device itself.
Versions are compared only. Nothing is sent to test for the vulnerabilities.
Only scan networks you own or are authorized to assess.
