CVE-2023-4346
highPriorität · handeln · 90OT-Risiko · kritischKEV · ausgenutztEPSS 0.014 · 72. PerzentilEUUShinzugefügt 2026-07-15beheben bis 2026-07-29
erforderliche Maßnahme Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
EPSS · bewertet 2026-10-26
KNX Association KNX Protocol Connection Authorization Option 1 Overly Restrictive Account Lockout Mechanism Vulnerability
KNX devices that use KNX Connection Authorization and support Option 1 are, depending on the implementation, vulnerable to being locked and users being unable to reset them to gain access to the device. The BCU key feature on the devices can be used to create a password for the device, but this password can often not be reset without entering the current password. If the device is configured to interface with a network, an attacker with access to that network could interface with the KNX installation, purge all devices without additional security options enabled, and set a BCU key, locking the device. Even if a device is not connected to a network, an attacker with physical access to the device could also exploit this vulnerability in the same way.
Behebungen
Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.
Noch kein Hersteller-Fix; eine Mitigation ist verfügbar.
- MitigationKNX devices using Connection Authorization Option 1 Style in which no BCU Key is currently setcisa_csaf_ot
The KNX Association also recommends developers always set the BCU Key in every KNX Project that is already finished and will be commissioned in the future. Handover the BCU Key as part of the Project Documentation to the Building Owner.
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen
SSVC
Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (4)
Betroffene Produkte und Versionsbereiche.
- knx connection authorizationalle VersionennvdUScpe:2.3:a:knx:connection_authorization:*:*:*:*:*:*:*:*
Advisories (1)
Hersteller- und Ökosystem-Meldungen dazu.
- ICSA-23-236-01KNX Protocol2023-08-24icsa · cisa_csaf_otUS
Successful exploitation of this vulnerability could cause users to lose access to their device, potentially with no way to reset the device.
auch bekannt als (3)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (7)
Externe Belege — Patches, Meldungen, Analysen.
- https://cxsecurity.com/cveshow/CVE-2023-4346/cnnvd
- https://www.auscert.org.au/bulletins/ESB-2023.4861cnnvd
- https://www.cisa.gov/news-events/ics-advisories/icsa-23-236-01cnnvd
- https://www.knx.org/knx-en/for-professionals/benefits/knx-secure/index.phpPatchcnnvd
- https://www.cisa.gov/news-events/ics-advisories/icsa-23-236-01enisa_euvd
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-4346US Government Resourcenvd
- https://www.cisa.gov/news-events/ics-advisories/icsa-23-236-01Third Party AdvisoryUS Government Resourcenvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan