Censys Adds 14 Scanners to Identify Exposed Building, Database, Mesh, and Camera Systems
Summary
Censys added 14 protocol and endpoint scanners, including for KNX/IP, Redshift, Tailscale DERP, and TVT camera controls, to help identify internet-exposed systems and prioritize security risks.
Key points
- Censys says the August release adds 14 scanners; the article spotlights four and provides queries for finding exposed services.
- More than 16,000 KNX systems are reportedly exposed online; the article cites a known exploited vulnerability and a campaign that locked building owners out of automation systems.
- Censys reports 1,173 internet-exposed Redshift endpoints, despite AWS disabling public accessibility by default on new clusters in 2025.
- An exposed Tailscale DERP relay can reveal the presence and approximate location of a private mesh network; Tailscale patched a mesh-authentication timing side channel in 2025.
- TVT camera-control services are associated with ongoing botnet activity exploiting credential-related flaws in DVRs and web APIs.
Article Details
- Event Type
- Censys added 14 protocol and endpoint scanners to its Internet mapping platform, including scanners for KNX/IP, Amazon Redshift, Tailscale DERP, and TVT camera control.
- Impact
- The article reports exposed KNX, Redshift, DERP, and TVT services, alongside risks including building-system lockouts, potential recovery of a shared mesh secret, and botnet exploitation of TVT DVR vulnerabilities. It cites 1,173 exposed Redshift endpoints and intrusion attempts against vulnerable TVT DVRs from 6,600 unique IPs in one month.
CVE
Malware
Vendors
AmazonAmazon Redshift is where organizations store years of sales records, customer information, and operational history for internal analytics teams.Amazon Web ServicesAWS disabled public accessibility by default on new Redshift clusters in 2025 (AWS Security Blog).CensysCensys continuously maps the entire Internet.Schneider ElectricSchneider Electric reissued hardening guidance in response (SecurityWeek).TailscaleTailscale DERP: exposing your private mesh network’s existenceTVTTVT camera control: dozens of camera brands, one exposed channel
Products
Amazon RedshiftAmazon Redshift is where organizations store years of sales records, customer information, and operational history for internal analytics teams.Censys PlatformCensys Platform Query: host.services.protocol:"KNXIP"KNX/IPKNX/IP: the system that decides whether your doors lockTailscale DERPTailscale DERP: exposing your private mesh network’s existenceTVT NVMS-9000Meanwhile, Juniper Threat Labs tracked a botnet exploiting hardcoded credentials in the TVT NVMS-9000 web API, active in the wild since 2019 (Juniper Networks).TVT NVMS9000Since April 2025, a Mirai-based botnet has been exploiting a cleartext credential-disclosure flaw in TVT NVMS9000 DVRs (BleepingComputer).