HVAC Network Scanner Files

The scanner now keeps its advisory list current by itself, and updates install themselves when you close it. Full details are in CHANGELOG.md (github.com). The project's website is jamesccupps.github.io/HVAC-Network-Scanner.

Already on 2.10, 2.11 or 2.12? Press Update to 2.13.0 in the header, or wait for the daily check. From this release on, updates install themselves. Copies older than 2.10 need this download once.

Download

HVACNetworkScanner.exe is the GUI as one file; no Python needed. It was built by GitHub Actions from the v2.13.0 tag (build log), with PyInstaller and its dependencies pinned by hash.

SHA-256  06DF5857A5F2D32BECE08AAAB59859D04836E0638E100822120B7D22877E647C

Check it before running. The same hash is in HVACNetworkScanner.exe.sha256:

:::powershell
Get-FileHash .\HVACNetworkScanner.exe -Algorithm SHA256

The build signs an attestation that this exact file came from that workflow run and commit. To verify it with the GitHub CLI:

:::powershell
gh attestation verify .\HVACNetworkScanner.exe --repo jamesccupps/HVAC-Network-Scanner

The executable is not code-signed, so Windows SmartScreen will say "Windows protected your PC". Once the hash matches, use More info → Run anyway. If Windows Firewall asks, allow it on the networks you scan, or BACnet replies to a broadcast will be dropped.

The advisory list updates itself

• Daily rebuild. A daily GitHub job reads CISA's machine-readable advisory data (CSAF) and rebuilds the entries for the products the scanner can match:
• Trane Tracer SC and SC+
• Siemens APOGEE PXC on BACnet firmware
• Desigo DXR2, PXC4/5/7 and Desigo CC

When anything changes, it publishes the list signed with a key used only for this list. The app's updater never trusts that key.

• The scanner's daily check downloads the signed list, verifies it, and uses it if it is newer than the one built in. --update-advisories does the same from the command line. The report says which list it used and how current it is.
• Every CISA advisory for these products. The list now has 53 entries, against 13 in 2.12. It adds older APOGEE, Tracer SC and SC+, and Desigo CC advisories.
• Desigo CC per release. A Desigo CC server reports its release (9.00 is V9.0), so it is checked only against the advisories that can apply to that release.
• New products. Advisories for building-automation products the list can't match yet become issues to review.

Versions are compared only. Nothing is sent to test for the vulnerabilities.

Updates install themselves

Install updates automatically is new in Advanced, and on by default. The daily check downloads a new release quietly and verifies it against the release's signed latest.json. The scanner installs it when you close it. Restart to update to … in the header installs it at once. A window left open checks again once a day. Turn the setting off to be asked first, as before.

Only scan networks you own or are authorized to assess.