CVE-2023-4346: KNX Association KNX Protocol Connection Authorization Option 1 Overly Restrictive Account Lockout Mechanism Vulnerability
KNX Association KNX Protocol Connection Authorization Option 1 contains an overly restrictive account lockout mechanism vulnerability that could allow an attacker to purge all devices without additional security options enabled and set a BCU key to lock the device.
Overview
KNX devices that use KNX Connection Authorization and support Option 1 are, depending on the implementation, vulnerable to being locked and users being unable to reset them to gain access to the device. The BCU key feature on the devices can be used to create a password for the device, but this password can often not be reset without entering the current password. If the device is configured to interface with a network, an attacker with access to that network could interface with the KNX installation, purge all devices without additional security options enabled, and set a BCU key, locking the device. Even if a device is not connected to a network, an attacker with physical access to the device could also exploit this vulnerability in the same way.
Vulnerability details
CVE-2023-4346 affects KNX devices that implement Connection Authorization Option 1, a protocol-level access control mechanism used in building automation systems. The weakness (CWE-645) describes an overly restrictive lockout mechanism that an attacker can deliberately trigger. In this case, the BCU key feature allows a password to be written to a device, but the design provides no recovery path without the current key. When a device lacks additional security options, the protocol accepts BCU key write commands without sufficient authentication, making the lockout condition trivially reachable by any party with access to the KNX bus.
An attacker with network access to the KNX installation sends protocol commands to target devices: first purging existing settings on devices that have no additional security options active, then writing a new BCU key. Once set, the BCU key cannot be reset without the attacker-controlled value, permanently locking legitimate administrators out of the affected devices. The same attack path is available to an attacker with physical access to the device. The result is permanent denial of availability: affected devices are rendered inaccessible or under the attacker's exclusive control, with no recovery mechanism available to the legitimate owner.
Severity and impact
Exploitation status
This vulnerability is confirmed as actively exploited in the wild — it is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.
Detection and monitoring
- Monitor KNX bus traffic for BCU key write commands or device purge operations originating from sources outside the authorized engineering workstation or KNX IP gateway address range. These commands have no legitimate reason to originate from unrecognized sources.
- Audit device accessibility periodically: a KNX device that no longer responds to authorized configuration tools, or that rejects credentials that previously succeeded, may have had a BCU key set by an unauthorized party.
Remediation
Additional hardening
- The affected product version range carries no fixed-version boundary in the available facts. Consult the vendor advisory listed in References for current remediation guidance and apply any available firmware or configuration updates.
- Enable additional KNX security options on all devices where supported, such as pre-configuring a BCU key under administrator control before deployment, so unauthenticated key-write commands are rejected.
- Restrict network access to the KNX installation using firewalls or VLANs so that only authorized engineering workstations and KNX IP gateways can reach the KNX bus segment.
- For devices with physical access exposure, apply physical security controls (locked enclosures, restricted facility access) to prevent an attacker from reaching the device interface directly.
Key dates
References
- https://www.cisa.gov/news-events/ics-advisories/icsa-23-236-01
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
- https://nvd.nist.gov/vuln/detail/CVE-2023-4346
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-4346
Frequently asked questions
Does CVE-2023-4346 affect my FedRAMP authorization?
If KNX Association KNX Protocol Connection Authorization Option 1 runs inside your authorization boundary, CVE-2023-4346 creates a direct FedRAMP compliance obligation. CISA has listed this vulnerability in its Known Exploited Vulnerabilities catalog, with a remediation deadline of July 29, 2026. An unpatched Known Exploited Vulnerability inside your boundary is an assessor finding. You must either remediate it or formally document a mitigation before your assessor and sponsoring agency raise it.
How does Knox help me handle CVE-2023-4346?
Remediating KNX Association KNX Protocol Connection Authorization Option 1 is your responsibility under the FedRAMP shared-responsibility model. Knox does not patch your software. What Knox provides is the pre-authorized, single-tenant boundary to remediate within, plus Knox's automated continuous monitoring platform and audit-artifact coverage to help you document the fix for your next assessment. The remediation is yours to apply; maintaining a compliant posture while you apply it is not something you manage alone.
How does Knox's monitoring help with vulnerabilities like this?
Knox's automated continuous monitoring platform watches your environment for newly disclosed vulnerabilities and compliance issues on a continuous basis. When a vulnerability like CVE-2023-4346 surfaces, exposure is identified through ongoing monitoring rather than surfacing only when an assessor flags it at review time.
How do I get FedRAMP authorized with Knox?
Knox runs a FedRAMP-as-a-Service platform. It gives SaaS vendors a pre-authorized cloud boundary on AWS, Azure, and GCP. Your application inherits 60-80% of the required security controls. You reach FedRAMP authorization in about 90 days for roughly 90% less than the traditional $3.5M path. Book a meeting and Knox will map your path to authorization.
What happens if CVE-2023-4346 isn't remediated by July 29, 2026?
Missing the July 29, 2026 deadline turns CVE-2023-4346 into a Plan of Action and Milestones (POA&M) item. A growing POA&M list is what converts a routine continuous-monitoring review into a difficult conversation with your sponsoring agency. Meeting the deadline keeps your authorization clean and the agency relationship intact.
Ready to achieve FedRAMP authorization in 90 days or less?
Schedule a meeting to discuss scope, parse readiness, and map your company’s accelerated path to FedRAMP authorization.
_Horizontal_RGB.png)
