CVE-2023-4346
📋 TL;DR
KNX devices with Connection Authorization Option 1 are vulnerable to permanent lockout attacks. An attacker with network or physical access can purge devices and set a BCU key password, preventing legitimate users from accessing or resetting the device. This affects KNX building automation systems used in smart buildings.
💻 Affected Systems
- KNX devices with Connection Authorization supporting Option 1
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete denial of service for building automation systems - lighting, HVAC, security, and other KNX-controlled systems become permanently inaccessible, requiring physical device replacement.
Likely Case
Targeted lockout of critical building systems causing operational disruption and requiring physical intervention to restore functionality.
If Mitigated
Minimal impact if devices are properly segmented and additional security options are enabled, preventing unauthorized access.
🎯 Exploit Status
Exploitation requires network or physical access but no authentication. The attack sequence is straightforward once access is obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: N/A
Vendor Advisory: https://www.cisa.gov/news-events/ics-advisories/icsa-23-236-01
Restart Required: No
Instructions:
No firmware patch available. Follow CISA advisory recommendations: 1. Enable additional security options beyond Option 1. 2. Implement network segmentation. 3. Restrict physical access to KNX devices.
🔧 Temporary Workarounds
Enable Additional Security Options
allConfigure KNX devices to use security options beyond Connection Authorization Option 1, such as device authentication or encryption.
Network Segmentation
allIsolate KNX networks from general corporate networks using VLANs or physical separation.
🧯 If You Can't Patch
- Implement strict physical access controls to KNX device locations
- Monitor KNX network traffic for unauthorized purge or BCU key setting attempts
🔍 How to Verify
Check if Vulnerable:
Check if KNX devices are configured with Connection Authorization Option 1 without additional security options enabled. Review device configuration via KNX engineering tools.Check Version:
Use KNX device manufacturer tools to check device configuration and security settings.Verify Fix Applied:
Verify that additional security options are enabled and devices are not using only Option 1. Confirm network segmentation is in place.📡 Detection & Monitoring
Log Indicators:
- KNX device purge events
- BCU key setting attempts from unauthorized sources
- Connection authorization failures
Network Indicators:
- KNX network traffic from unauthorized IP addresses
- Purge commands on KNX network
- BCU key setting commands
SIEM Query:
source="knx_device" AND (event_type="purge" OR event_type="bcu_key_set")