CVE-2023-4346

The vulnerability associated with KNX devices utilizing Connection Authorization, particularly those supporting Option 1, presents significant security concerns due to the potential for unauthorized access and device locking. The core issue lies in the implementation of the BCU key feature, which is designed to create a password for the device. However, the design flaw allows for scenarios where users cannot reset the password without the current one, effectively locking them out of their own devices. This situation is exacerbated by the fact that if the device is connected to a network, an attacker can exploit this vulnerability remotely, while physical access to the device also enables an attacker to execute similar malicious actions.

Attack vectors for this vulnerability are twofold: remote and physical. In a networked environment, an attacker with access to the local network can interface with the KNX installation, purging all devices that lack additional security measures. This action not only disrupts the functionality of the KNX system but also allows the attacker to set a new BCU key, thereby locking legitimate users out of their devices. In scenarios where the device is not networked, physical access provides an attacker with the same capabilities, allowing them to manipulate the device directly. This duality of attack vectors increases the risk profile of KNX installations, particularly in environments where physical security may be lax.

The real-world impact of this vulnerability can be profound, especially in commercial and residential settings that rely on KNX devices for automation and control. Businesses may face operational disruptions, leading to financial losses and reputational damage. For instance, in a smart building environment, losing access to critical systems such as lighting, HVAC, or security could result in not only inconvenience but also safety hazards. Furthermore, the inability to regain access to these devices can lead to increased costs associated with recovery efforts, including potential hardware replacements or extensive troubleshooting.

Detection and mitigation strategies must be robust to address this vulnerability effectively. Organizations should conduct thorough assessments of their KNX installations to identify devices that utilize Connection Authorization and support Option 1. Implementing additional security measures, such as network segmentation and enhanced access controls, can help mitigate the risk of unauthorized access. Regular audits and updates to the firmware of KNX devices are also essential to ensure that any known vulnerabilities are patched promptly. Moreover, educating users about the importance of maintaining secure passwords and the implications of physical access to devices can further reduce the likelihood of exploitation.

In conclusion, the vulnerabilities present in KNX devices utilizing Connection Authorization highlight critical security weaknesses that can be exploited both remotely and physically. The potential for operational disruption and financial loss necessitates a proactive approach to security, emphasizing the importance of robust detection and mitigation strategies. By understanding the nature of the vulnerability and implementing comprehensive security measures, organizations can better protect their KNX installations from malicious actors.

CSURFACE threat intelligence has detected a marked escalation in activity related to CVE-2023-4346, coinciding with its recent inclusion in the CISA Known Exploited Vulnerabilities (KEV) catalog. This formal recognition underscores the growing operational relevance of this vulnerability within KNX devices employing Connection Authorization Option 1. Although no new exploit techniques have been publicly disclosed, the elevation of the CVSS score to 7.5 and the corresponding increase in EPSS indicate an increased likelihood of exploitation attempts in the near term. Our telemetry reflects a significant uptick in scanning and probing behaviors targeting affected devices, suggesting adversaries are actively assessing network environments for potential entry points. This shift elevates the threat posture for defenders managing KNX installations, as the vulnerability’s impact—locking devices and preventing user resets—could disrupt critical building automation functions. Consequently, the risk assessment for CVE-2023-4346 has been raised to high severity, emphasizing the necessity for heightened monitoring and prioritization within asset management frameworks.

Update 2 — August 01, 2026

CSURFACE threat intelligence has identified a modest but consistent increase in activity related to CVE-2023-4346, reflected by a rising trend in telemetry signals and a near doubling of the Exploit Prediction Scoring System (EPSS) value. This upward movement indicates that adversaries are incrementally intensifying reconnaissance and potential exploitation efforts against KNX devices utilizing Connection Authorization Option 1. Although no new exploit variants or ransomware associations have been detected, the growing EPSS score suggests an elevated likelihood of exploitation attempts in operational environments. For defenders, this signals a heightened risk of device lockout incidents that could disrupt critical building automation systems, underscoring the importance of vigilant monitoring. The threat level remains high, but the evolving data warrants increased attention to this vulnerability as adversaries appear to be probing for weaknesses more actively than before.