Security model
What the controller trusts, what it expects from your network, and what each interface allows.
AdiaPure is built for a managed building-services or industrial network, not for the open internet. This page states what the controller trusts, what it expects from the network around it, and what someone can do over each interface. Read it before you install the unit, and pass it on to whoever owns the network.
The short version
- No interface asks for a password. The web interface, Modbus, BACnet and the USB service port are all open. Anyone who can reach the controller can read and change every setting, including settings that stop the unit or reset it.
- Nothing is encrypted. Every protocol runs in plaintext. A listener on the network can read everything the unit sends and receives.
- The network is the security boundary. The controller must sit on its own network segment (a dedicated VLAN), separated from office and internet-facing networks. Never expose it directly to the internet.
- Physical access is full access. Inside the enclosure, the service and debug connections give complete control of the unit. Keep the enclosure closed and the plant room access-controlled.
- The web interface is a commissioning and local monitoring tool, not a secured management interface.
What the network must provide
These are installation requirements, not preferences:
- Put the controller on its own network segment. A dedicated VLAN shared only with the devices that need to talk to it — the BMS controller, the commissioning workstation — is the baseline. The protocols the controller speaks (HTTP, Modbus, BACnet) carry no authentication and no encryption, so the segment is what keeps unauthorised hosts away.
- Do not expose the controller to the internet. No port forwarding, no reverse proxy from outside, no placement in a DMZ.
- Restrict the ports at the switch or firewall. Where you can, allow TCP 80 (web interface), TCP 502 (Modbus/TCP) and UDP 47808 (BACnet/IP) only from the hosts that need them.
- Do not share the segment with untrusted devices. A compromised device on the same segment can do everything this page lists.
The controller boots to a published default address (192.168.1.195) and announces
itself on the network with an ARP broadcast, so a network scan finds it easily. See
Networks that need 802.1X.
What each interface allows
| Interface | Who can reach it | What they can do |
|---|---|---|
| Web interface (TCP 80) | Anyone on the segment | Read all values; change every setting the pages expose |
| Modbus/TCP (TCP 502) | Anyone on the segment | Read and write the whole register map |
| BACnet/IP (UDP 47808) | Anyone on the segment | Read and write every object, including objects the object list does not advertise |
Fieldbus RS-485 (J6) | Anyone who can attach to the bus | Read and write the register map over Modbus RTU or BACnet MS/TP |
USB service port (J32, inside the enclosure) | Anyone with the enclosure open | Write every register, including the ones the fieldbus leaves read-only, and apply firmware updates |
Screen link (J5) | The fitted screen only | The screen is a trusted partner; it writes the settings the operator enters |
| Screen USB-C | Anyone who can touch the screen | Reprogram the screen |
Two consequences worth spelling out:
- An object that is hidden from the BACnet object list still exists. It can be read and written by its object instance number even though it is not advertised. Do not rely on "not in the list" as protection.
- The screen writes to the controller too. Settings entered on the screen are written to the controller over the screen link, so whoever controls the screen controls those settings. Treat the screen's USB-C connector like the service port: access to it is access to the unit's front end.
The web interface
The web interface has no login, no password and no encryption. It is there for
commissioning and for monitoring on the unit's own segment. Anyone on the segment who can
open http://<address> can change the configuration.
- Use it from a computer on the controller's own segment.
- Do not make it reachable from office networks, guest networks or the internet.
- If you must reach it from further away, restrict TCP 80 at the switch to that one workstation — and prefer reading values through the BMS integration instead.
Physical access
The enclosure is part of the security design. Inside it, the USB service port J32
gives full register access and carries the firmware update protocol (updates are applied
by DSH Belgium), and the board carries a debug connection that gives complete access to
the controller. Keep the enclosure closed and locked, and treat plant-room access as part
of the security of the unit.
The screen sits on the outside of the enclosure; its USB-C connector is a programming port. See the table above for what that means.
If you find a security problem
Email [email protected] rather than opening a public issue. The security policy covers how reports are handled, what is supported and what happens after you report.