KNX devices that use KNX Connection Authorization and support Option 1 are, depending on the implementation, vulnerable to being locked and
KNX devices using Connection Authorization Option 1 with no BCU Key set are affected, across all versions. No fixed version is listed; the KNX Association recommends setting a BCU Key in every project.
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Actively exploited
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
KNX devices that use KNX Connection Authorization with Option 1 support can be locked against their owners, leaving users unable to reset them and regain access. An attacker with network access to the KNX installation, or physical access to a device, could set a BCU key that locks out legitimate users.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
KNX devices that use KNX Connection Authorization and support Option 1 are, depending on the implementation, vulnerable to being locked and users being unable to reset them to gain access to the device. The BCU key feature on the devices can be used to create a password for the device, but this password can often not be reset without entering the current password. If the device is configured to interface with a network, an attacker with access to that network could interface with the KNX installation, purge all devices without additional security options enabled, and set a BCU key, locking the device. Even if a device is not connected to a network, an attacker with physical access to the device could also exploit this vulnerability in the same way.
Timeline
- CVE published
- Added to CISA KEV
CISA has evidence of exploitation in the wild
- Record last updated
- CISA remediation deadline
Due date for US federal agencies to patch
Affected versions
- KNX Association KNX Protocol Connection Authorization Option 1
0
References 1
Questions about CVE-2023-4346
What does this mean?
An attacker on a network the device is configured to interface with can purge the device and set a BCU key. This locks the owner out, who may be unable to reset the device and regain access.Source: cisa.gov
Am I affected, and how do I check?
Affected devices use the Connection Authorization Option 1 style and have no BCU Key currently set, in all versions. The network attack path applies only if the device is configured to interface with a network, so check the device's BCU Key status and its network configuration in its KNX project.Source: cisa.gov
What should I do about it?
The KNX Association recommends always setting the BCU Key in every KNX project that is already finished and will be commissioned in the future. No fixed version is listed in the facts.Source: cisa.gov
Is it being exploited?
Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2026-07-15, which means it has evidence of attacks. No public exploit code is tracked.Source: cisa.gov, cve.now feed data
What if there's no patch?
No fixed version is listed. The workaround is to always set the BCU Key in every finished KNX project that will be commissioned in the future.Source: cisa.gov