CVE-2023-4346: KNX Association KNX Protocol Connection Authorization Option 1 Overly Restrictive Account Lockout Mechanism Vulnerability
KNX devices that use KNX Connection Authorization and support Option 1 are, depending on the implementation, vulnerable to being locked and users being unable to reset them to gain access to the device. The BCU key feature on the devices can be used to create a password for the device, but this password can often not be reset without entering the current password. If the device is configured to interface with a network, an attacker with access to that network could interface with the KNX installation, purge all devices without additional security options enabled, and set a BCU key, locking the device. Even if a device is not connected to a network, an attacker with physical access to the device could also exploit this vulnerability in the same way.
How it works
The weakness is categorized as CWE-645, an overly restrictive account lockout mechanism. In this product class an attacker can trigger repeated failed authorization attempts against the connection authorization process. Because the lockout behavior is overly broad, the mechanism clears device state across the installation and permits the attacker to install a BCU key that prevents further legitimate access.
Am I affected? How to find it in your systems
KNX Protocol implementations are commonly found in building automation, lighting, HVAC, and access-control installations. Inventory all KNX-enabled controllers, interfaces, and gateways on your networks. Confirm whether Connection Authorization Option 1 is in use and whether any additional security options are disabled. Review vendor-supplied configuration exports or device firmware listings; exact version checks and affected configurations must be confirmed against the vendor advisory. Monitor KNX/IP traffic and device logs for repeated authorization failures followed by mass device resets or key changes.
How to remediate
Apply mitigations in accordance with vendor instructions. Verify that any updates or configuration changes meet the requirements of CISA BOD 26-04 for prioritizing security updates based on risk. After applying the vendor update, enable any additional security options that were previously disabled and re-test device authorization behavior.
- Document the current state of every KNX installation before changes.
- Re-apply device keys and authorization settings from a known-good backup after the update.
If you can't patch immediately
Segment KNX networks from general-purpose IT networks and restrict management traffic to authorized hosts only. Disable internet exposure of any KNX/IP gateways where feasible. Increase monitoring of KNX bus and IP traffic for authorization anomalies while the vendor fix is applied. If mitigations cannot be implemented, evaluate discontinuing use of the affected product per CISA guidance.
If your data may have been exposed
Actively exploited vulnerabilities in this class have led to unauthorized device access. Run a free exposure scan of your organization’s email addresses against known breach data to determine whether credentials or device identifiers have already appeared in public records.
AICompiled with AI assistance from public sources and published under our editorial standards.
Details
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H