CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

KNX Connection Authorization Option 1 overly-restrictive account-lockout DoS (CVSS 7.5, CWE-645); CISA KEV 2026-07-15, no software patch (procedural mitigation)

cve · CVE-2023-4346 single-source-national-cert

Coverage
1
first 2026-07-16 → last 2026-07-16
Latest activity
2026-07-16
A three-year-old KNX Connection Authorization lockout flaw joins CISA KEV as actively exploited; the fix is…
Peak priority
notable
1 notable
Targets
energy
sectors: energy, water, healthcare · regions: europe
Sources cited
2
1 hosts

Action items (1)

Do-now tasks recorded on the entries about CVE-2023-4346, newest first. Check the date before acting on an older one.

  • Set the BCU key on every KNX Connection Authorization Option-1 device that lacks one (per the KNX Secure Checklist) and place IP-KNX routers/gateways behind a firewall, off any internet-reachable segment; there is no patch, so segmentation and commissioning hygiene are the only controls.
    2026-07-16CVE-2023-4346

Defender insights

What each entry about CVE-2023-4346 tells a defender to do, newest first.

2026-07-16NOTABLEexploitedA three-year-old KNX Connection Authorization lockout flaw joins CISA KEV as actively exploited; the fix is procedural, not a patch

Story timeline

  1. 2026-07-16CVE-2023-4346, KNX building-automation protocol: account-lockout DoS added to CISA KEV, no software patch (CVSS 7.5)
    trending-vulnerabilitiesA three-year-old KNX Connection Authorization lockout flaw joins CISA KEV as actively exploited; the fix is procedural, not a patch

Hunting pivots

Affected products
KNX Connection Authorization Option 1 devices (no BCU key set)
Tags
actively-exploitedcisa-kevdosno-patchot-icsvulnerabilities
ATT&CK techniques (1 across 1 tactic)

1 technique observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)

  • ImpactEndpoint Denial of Service

Impact TA0040

T1499Endpoint Denial of Service×1

Adversaries may perform Endpoint Denial of Service (DoS) attacks to degrade or block the availability of services to users. Endpoint DoS can be performed by exhausting the system resources those services are hosted on or exploiting the system to cause a persistent crash condition. Example services include websites, email services, DNS, and web-based applications. Adversaries have been observed conducting DoS attacks for political purposes and to support other malicious activities, including distraction, hacktivism, and extortion.

Evidence: 2026-07-16/cve-2023-4346-knx-building-automation-lockout-dos-kev · ATT&CK page ↗

Entries about KNX Connection Authorization Option 1 overly-restrictive account-lockout DoS (CVSS 7.5, CWE-645); CISA KEV 2026-07-15, no software patch (procedural mitigation) (1)

2026-07-16 · view entry permalink →

NOTABLECVE-2023-4346exploitedNATOA2

CVE-2023-4346, KNX building-automation protocol: account-lockout DoS added to CISA KEV, no software patch (CVSS 7.5)

CISA added CVE-2023-4346 to its Known Exploited Vulnerabilities catalog on 15 July 2026, alongside the Oracle E-Business Suite flaw, and updated the underlying ICS advisory to carry a "known public exploitation" note (CISA ICSA-23-236-01, 2026-07-15; CISA KEV alert, 2026-07-15). The flaw itself is three years old (reported by Felix Eberstaller of Limes Security and published in August 2023) and had no prior KEV listing until this update. KNX is a widely deployed European building-automation bus protocol (KNX Association is headquartered in Belgium) used for HVAC, lighting, access control and BMS integration, so the exposure sits under any large public-sector or critical-infrastructure estate with smart-building controls.

The design flaw (CWE-645, overly restrictive account-lockout mechanism, CVSS 7.5, availability-only) is in KNX Connection Authorization Option 1: any device that has never had its BCU (Bus Coupling Unit) key set can be purged by an attacker with network access to the KNX installation, who then sets a new BCU key and permanently locks legitimate operators out, with no reset path short of the current password (CISA ICSA-23-236-01, 2026-07-15). An attacker with only physical access to the bus can do the same. KNX Association has issued no software fix in three years; the remediation is entirely procedural, set the BCU key during commissioning.

Exploitable remotely/low attack complexity/known public exploitation

If the device is configured to interface with a network, an attacker with access to that network could interface with the KNX installation, purge all devices without additional security options enabled, and set a BCU key, locking the device.

CISA (ICS Advisory ICSA-23-236-01) 2026-07-15
vulnerability16 Jul 04:36Zsingle-source · national CERTOpen finding →
Sources: CISA (ICS Advisory ICSA-23-236-01) · CISA

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Vulns1

Source distribution

  • cisa.gov2 (100%)

External references

NVD · cve.org · CISA KEV

All cited sources (2)