KNX smart-home systems can be locked by attackers
A flaw in KNX smart-home systems lets attackers lock out users from controlling lights, locks, or thermostats. This can disrupt homes or businesses that rely on these automated systems.
- Severity
- HighCVSS 3.1 · 7.5
- Fix
- Not confirmedLast checked on Sep 4, 2026
- Affected versions
- 0
- Weakness
- CWE-645
- Exploit likelihood
- 1.3% in 30 daysEPSS, higher than 69% of known flaws
- Affects
- KNX Protocol Connection Authorization Option 1
- Exploited
- Yes, in the wildListed by CISA
- Added to CISA list
- Jul 15, 2026
- Federal fix deadline
- Jul 29, 2026
How it works
An attacker sends too many failed login attempts to the KNX system's connection authorization feature, which then locks the account without proper recovery options.
What to do
Check whether the installed KNX version is older than the fixed version in the vendor advisory or current release.
Update to the latest patched version of your KNX system software or apply the vendor's recommended fix immediately to prevent account lockouts.
Technical details
Affected software: KNX Protocol Connection Authorization Option 1by KNX Association
CVE-2023-4346 affects KNX devices using KNX Connection Authorization with Option 1. The BCU key mechanism sets a device access password, but that password typically cannot be reset without supplying the current one first. An attacker with network access to the KNX bus, or physical access to a device, can use the authorization process to purge all devices that do not have additional security options enabled, then set a new BCU key.
This locks legitimate operators out of reconfiguring those devices, since the reset path depends on already knowing the password that was just replaced. CVSS and exploitation data classify this as a denial-of-access issue rather than data theft or code execution.
Severity breakdown
- Attack vector Network Requires network access to the vulnerable service
- Attack complexity Low Low complexity under the assessed conditions
- Privileges required None Attacker needs no account or login
- User interaction None No victim action needed
- Scope Unchanged Impact stays within the same security authority
- Confidentiality impact None No data disclosure
- Integrity impact None No data tampering
- Availability impact High The service can stop or suffer serious disruption
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Open in FIRST.org calculatorReferences
- cisa.gov · icsa-23-236-01 Third Party Advisory US Government Resource
- cisa.gov · known-exploited-vulnerabilities-catalog US Government Resource