{"id":"CVE-2023-4346","kind":"vulnerability","aliases":["CVE-2023-4346"],"related":[],"title":"KNX devices that use KNX Connection Authorization and support Option 1 are, depending on the implementation,…","description":"KNX Association KNX Protocol Connection Authorization Option 1 contains an overly restrictive account lockout mechanism vulnerability that could allow an attacker to purge all devices without additional security options enabled and set a BCU key to lock the device.\n\nCISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","summary":"KNX building-automation devices use an overly restrictive account lockout in their connection authorization, which lets an attacker purge all devices and set a BCU key that locks the device. CISA lists it as actively exploited in the wild.","severity":"high","cvss":7.5,"epss":null,"exploited":true,"exploited_at":"2026-07-15T00:00:00+00:00","products":[{"name":"KNX Association KNX Protocol Connection Authorization Option 1","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"knx connection authorization","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["building-automation","exploited","infrastructure","ip-gateways","knx"],"not_affected_if":["knx-security-enabled","no-knx-devices"],"how_to_check":null,"fix":"Apply the vendor mitigation from KNX Association; CISA's KEV entry says to follow vendor instructions and discontinue use if no mitigation is available.","status":"open","published_at":"2023-08-29T20:15:10+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:33:38+00:00","updated_at":"2026-10-23T23:44:51+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T20:33:38Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor mitigation from KNX Association; CISA's KEV entry says to follow vendor instructions and discontinue use if no mitigation is available.","summary":"KNX building-automation devices use an overly restrictive account lockout in their connection authorization, which lets an attacker purge all devices and set a BCU key that locks the device. CISA lists it as actively exploited in the wild.","category":"infrastructure","who_cares":["knx","building-automation","ip-gateways"],"confidence":0.6,"analyst_note":"Sources do not name affected firmware versions or the vendor advisory; find the KNX Association advisory for CVE-2023-4346 and the list of affected and fixed device models.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-knx-devices","knx-security-enabled"],"severity_if_unknown":"high"},"cost_usd":0.000379,"input_tokens":2278,"output_tokens":302,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-04':139C,165C,196C '-2023':18A,21A '-4346':19A,22A '1':11A,30A,90C '26':138C,164C,195C 'accord':128C 'account':52B,95C 'action':124C 'activ':78B 'addit':109C 'adher':192C 'allow':101C 'appli':125C 'applic':162C 'asset':186C 'associ':84C 'association':24A 'attack':61B,103C 'author':7A,57B,88C 'authorization':28A,33A 'autom':36B,46B 'base':143C 'bcu':68B,116C 'bod':137C,163C,194C 'build':35B,45B 'building-autom':34B,44B 'cisa':74B,122C,135C,152C 'cloud':168C 'complianc':133C 'connect':6A,56B,87C 'connection':27A,32A 'contain':91C 'could':100C 'cve':17A,20A 'depend':13A 'devic':2A,47B,64B,73B,107C,121C 'discontinu':171C 'enabl':112C 'ensur':132C,191C 'evalu':184C 'exploit':37B,79B 'exposur':189C 'follow':161C 'forens':154C 'gateway':41B 'guidanc':150C,166C 'guidelin':198C 'implement':16A 'infrastructur':38B 'instruct':131C 'internet':188C 'ip':40B 'ip-gateway':39B 'key':69B,117C 'knx':1A,5A,23A,25A,31A,42B,43B,83C,85C 'let':59B 'list':75B 'lock':71B,119C 'lockout':53B,96C 'mechan':97C 'mitig':126C,177C 'note':149C,160C 'option':10A,29A,89C,111C 'over':50B,93C 'patch':197C 'priorit':140C 'product':175C 'protocol':26A,86C 'purg':62B,105C 'requir':123C,156C 'respons':182C 'restrict':51B,94C 'risk':145C 'secur':110C,141C 'see':146C,157C 'servic':169C 'set':66B,114C 'stakehold':180C 'support':9A 'triag':155C 'unavail':179C 'updat':142C 'url':147C,158C 'use':4A,48B,172C 'vendor':130C 'vulner':98C 'wild':82B 'without':108C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2023-08-29T20:15:10+00:00","kev":{"dateAdded":"2026-07-15","dueDate":"2026-07-29","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"ics-cert@hq.dhs.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2023-4346","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-4346","severity":null,"published_at":"2026-07-15T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T11:39:13+00:00","note":null},{"source":"nvd","external_id":"CVE-2023-4346","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-4346","severity":null,"published_at":"2023-08-29T20:15:10+00:00","modified_at":"2026-07-16T05:16:16+00:00","first_seen_at":"2026-10-23T23:44:51+00:00","fetched_at":"2026-10-23T23:44:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}