A flaw in the KNX building automation protocol (CVE-2023-4346) — an attacker can wipe devices and lock the operator out
KNX, the protocol controlling building equipment such as lighting, HVAC, and blinds, has a connection authorization option with an overly restrictive account lockout mechanism. Where additional security options are not enabled, an attacker can purge all devices and set a BCU key to lock the device. CISA added it to the KEV catalog on 2026-07-15.
Key facts
- CVE IDCVE-2023-4346
- Affected (vendor / product)KNX Association KNX Protocol Connection Authorization Option 1
- CWECWE-645
- ExploitationListed in CISA KEV (exploitation confirmed)
- Remediation due2026-07-29 (U.S. federal civilian agencies, BOD 22-01)
Key points
- The affected product is KNX Association "KNX Protocol Connection Authorization Option 1"; CWE-645, overly restrictive account lockout.
- Where additional security options are not enabled, an attacker can purge all devices and set a BCU key to lock the device.
- KNX controls lighting, HVAC, blinds, and access control; device lifetimes are long and design assumptions persist for years.
- Lockout is normally a defense, but a thin release path lets an attacker trigger it deliberately and shut out the legitimate administrator.
- Added to KEV 2026-07-15 with a due date of 2026-07-29 — fourteen days, longer than the three-day entries this site holds as of 2026-08-28.
- On a building services network equipment lives ten or twenty years, and what is lost is availability — whether the building can be used.
1KNX is a standard for running a building
KNX connects and controls building equipment — lighting, HVAC, blinds, access control — over a single network. It is used in offices, hospitals, factories, and apartment buildings. Unlike information networks, these facility networks put continuous operation first, and device lifetimes run ten or twenty years. The assumptions made at design time stay in place for that long.
2When a lockout being too strict is the vulnerability
CWE-645 covers account lockout mechanisms that are overly restrictive. Lockout is normally a defense against brute forcing. But where the means of release is thin, an attacker can deliberately trigger the lockout and shut the legitimate administrator out. The record here goes further: after purging all devices, the attacker can set the BCU key — the key protecting the device — themselves. That does not merely stop the equipment; it closes the door back in.
3Different premises from information systems
On a facility network, taking devices offline to update means interrupting the operation of the building. It is also common for devices configured at installation to keep running untouched for years. The catalog's qualifier, "without additional security options enabled," indicates that countermeasures exist within the standard — whether they have been turned on in the field is a separate matter.
The remediation date is fourteen days from listing, longer than the three-day entries this site holds.
4Information networks and building networks start from different premises
A network controlling building equipment runs on different operating premises from an information network. Under the same word vulnerability, what is lost and what fixing requires both change.
The entry goes further, stating that an attacker can erase all devices and then set the BCU key themselves. Not only is the equipment stopped; the route back for recovery is closed too. The catalog's condition, where additional security settings are not enabled, shows the standard provides countermeasures — whether they are enabled on site is another matter.
Why it matters
Facility networks cannot take the same update cadence as information systems, since downtime for an update interrupts the building and device lifetimes are long. Devices left as configured at installation are also common. Even where the standard provides countermeasures, whether they are enabled in the field is a separate question, so taking inventory of what is actually turned on is the starting point.
FAQ
What is KNX?
Why is a strict lockout a vulnerability?
How does this differ from an information system flaw?
Sources (primary)
This article is an independent organization based on the U.S. official data below. Always verify the exact, latest details and applicability with the official and vendor sources.
- CISA KEV Catalog (known exploited list)
- NVD (CVE details / CVSS)
- Vendor / reference advisory
- This product uses data from the NVD API but is not endorsed or certified by the NVD. KEV data is CC0 (public domain).