CVE-2023-4346
published 2023-08-29CVE-2023-4346: KNX devices that use KNX Connection Authorization and support Option 1 are, depending on the implementation, vulnerable to being locked and users being unable…
PriorityP180high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
KEVITW
CISA Known Exploited Vulnerabilitydue 2026-07-29
Exploited in the wild
EPSS
0.85%
54.5th percentile
KNX devices that use KNX Connection Authorization and support Option 1 are, depending on the implementation, vulnerable to being locked and users being unable to reset them to gain access to the device. The BCU key feature on the devices can be used to create a password for the device, but this password can often not be reset without entering the current password. If the device is configured to interface with a network, an attacker with access to that network could interface with the KNX installation, purge all devices without additional security options enabled, and set a BCU key, locking the device. Even if a device is not connected to a network, an attacker with physical access to the device could also exploit this vulnerability in the same way.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| knx_association | knx_protocol_connection_authorization_option_1 | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Attacker with network access can interface with KNX installation, purge all devices without additional security options enabled, and set a BCU key to lock the device ↗
- →Attack is exploitable remotely with low attack complexity and no privileges or user interaction required; monitor KNX network segments for unauthorized BCU key write operations ↗
- →CISA has confirmed active exploitation in the wild; treat any unexpected BCU key changes or device lockouts on KNX installations as a potential incident ↗
- ·Only KNX devices using Connection Authorization Option 1 where NO BCU Key is currently set are affected; devices with a BCU key already configured are not the primary target of this attack path ↗
- ·Vulnerability impact depends on implementation; not all KNX Option 1 devices are equally susceptible — behaviour varies by vendor implementation ↗
- ·Physical access is also a viable attack vector, not just network access; air-gapping alone does not fully mitigate the risk ↗
- ·Active exploitation has been added to CISA KEV with a remediation due date of 2026-07-29; it is currently not publicly known how the flaw is being abused or by whom ↗
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vulncheck7.5HIGH
cisa7.5HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA
KNX Association KNX Protocol Connection Authorization Option 1 Overly Restrictive Account Lockout Mechanism Vulnerability
cisa·2026-07-15·CVSS 7.5
CVE-2023-4346 [HIGH] CWE-645 KNX Association KNX Protocol Connection Authorization Option 1 Overly Restrictive Account Lockout Mechanism Vulnerability
Vulnerability: KNX Association KNX Protocol Connection Authorization Option 1 Overly Restrictive Account Lockout Mechanism Vulnerability
Affected: KNX Association KNX Protocol Connection Authorization Option 1
KNX Association KNX Protocol Connection Authorization Option 1 contains an overly restrictive account lockout mechanism vulnerability that could allow an attacker to purge all devices without additional security options enabled and set a BCU key to lock the device.
Required Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue
CISA ICS
KNX Protocol
cisa_ics·2023-08-24·CVSS 7.5
[HIGH] KNX Protocol
ICS Advisory
##
KNX Protocol
Release DateAugust 24, 2023
Alert CodeICSA-23-236-01
## 1. EXECUTIVE SUMMARY
- CVSS v3 7.5
- ATTENTION: Exploitable remotely/low attack complexity/known public exploitation
- Vendor: KNX Association
- Equipment: KNX devices using KNX Connection Authorization
- Vulnerability: Overly Restrictive Account Lockout Mechanism
## 2. RISK EVALUATION
Successful exploitation of this vulnerability could cause users to lose access to their device, potentially with no way to reset the device.
## 3. TECHNICAL DETAILS
## 3.1 AFFECTED PRODUCTS
The following devices using KNX Protocol are affected:
- KNX devices using Connection Authorization Option 1 Style in which no BCU Key is currently set: All versions
## 3.2 VULNERABILITY OVERVIEW
3.2
VulDB
KNX Device Connection Authorization overly restrictive account lockout mechanism (icsa-23-236-01)
vuldb·2026-07-15·CVSS 7.5
CVE-2023-4346 [HIGH] KNX Device Connection Authorization overly restrictive account lockout mechanism (icsa-23-236-01)
A vulnerability categorized as critical has been discovered in KNX Device. This issue affects some unknown processing of the component Connection Authorization. Such manipulation leads to overly restrictive account lockout mechanism.
This vulnerability is uniquely identified as CVE-2023-4346. The attack can be launched remotely. Moreover, an exploit is present.
You are recommended to apply the suggested workaround.
GHSA
GHSA-qccg-qqvh-pq7q: KNX devices that use KNX Connection Authorization and support Option 1 are, depending on the implementation, vulnerable to being locked and users bein
ghsa_unreviewed·2023-08-29
CVE-2023-4346 [HIGH] CWE-645 GHSA-qccg-qqvh-pq7q: KNX devices that use KNX Connection Authorization and support Option 1 are, depending on the implementation, vulnerable to being locked and users bein
KNX devices that use KNX Connection Authorization and support Option 1 are, depending on the implementation, vulnerable to being locked and users being unable to reset them to gain access to the device. The BCU key feature on the devices can be used to create a password for the device, but this password can often not be reset without entering the current password. If the device is configured to interface with a network, an attacker with access to that network could interface with the KNX installation, purge all devices without additional security options enabled, and set a BCU key, locking the device. Even if a device is not connected to a network, an attacker with physical access to the device could also exploit this vulnerability in the same way.
VulnCheck
KNX Association KNX Protocol Connection Authorization Option 1 Overly Restrictive Account Lockout Mechanism Vulnerability
vulncheck·2023·CVSS 7.5
CVE-2023-4346 [HIGH] CWE-645 KNX Association KNX Protocol Connection Authorization Option 1 Overly Restrictive Account Lockout Mechanism Vulnerability
KNX Association KNX Protocol Connection Authorization Option 1 Overly Restrictive Account Lockout Mechanism Vulnerability
KNX Association KNX Protocol Connection Authorization Option 1 contains an overly restrictive account lockout mechanism vulnerability that could allow an attacker to purge all devices without additional security options enabled and set a BCU key to lock the device.
Affected: KNX Association KNX Protocol Connection Authorization Option 1
Required Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the pr
No detection rules found.
No public exploits indexed.
2023-08-29
Published
2026-07-15
Added to CISA KEV
Exploited in the wild