CVE-2023-4346

KNX Association KNX devices configured with Connection Authorization Option 1 can be locked out by an attacker because the BCU key (the device password) typically cannot be removed without entering the current password (CWE-645, an overly restrictive lockout mechanism). An attacker with access to the network used by the KNX installation can connect, purge all devices that lack additional security options, and set a BCU key; an attacker with physical access can do the same even on non-networked devices. The result is loss of availability: legitimate users are locked out of the device and often cannot reset it themselves (CVSS 7.5, availability impact only). Any deployment of KNX devices using the Connection Authorization Option 1 feature is affected; no specific firmware version ranges were published in the available data. CISA added the issue to its Known Exploited Vulnerabilities catalog on 2026-07-15, confirming exploitation in the wild, though no public proof-of-concept is known and ransomware use is unknown.

What to do: Per CISA's KEV listing and BOD 26-04 requirements, apply mitigations in line with vendor instructions: inventory KNX devices using Connection Authorization Option 1, restrict network access to KNXnet/IP interfaces and remote-access paths, and keep a documented copy of any BCU keys so devices can be unlocked. Review whether the connection authorization feature can be disabled or replaced with vendor-recommended more secure options; if mitigations are unavailable, follow BOD 26-04 guidance, including discontinuing use of internet-reachable KNX interfaces.