KNX Protocol
view advisory published 2023-08-24
Successful exploitation of this vulnerability could cause users to lose access to their device, potentially with no way to reset the device.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2023-4346US | high7.5OT critical | KEV | ||
KNX devices that use KNX Connection Authorization and support Option 1 are, depending on the implementation, vulnerable to being locked and users being unable to reset them to gai… | ||||
02
references
External citations — patches, advisories, analysis.
- ICS Advisory ICSA-23-236-01 JSONself
- Recommended Practicesexternal
- ICSA Advisory ICSA-23-236-01 - Web Versionself
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
03
remediations (1)
- MitigationKNX devices using Connection Authorization Option 1 Style in which no BCU Key is currently set
The KNX Association also recommends developers always set the BCU Key in every KNX Project that is already finished and will be commissioned in the future. Handover the BCU Key as part of the Project Documentation to the Building Owner.
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan