CVE-2023-4346

HIGHCVSS 7.5Known Exploited

CISA Known Exploited Vulnerability

https://www.cisa.gov/news-events/ics-advisories/icsa-23-236-01 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2023-4346

Remediation deadline: July 29, 2026

Description

KNX Association KNX Protocol Connection Authorization Option 1 contains an overly restrictive account lockout mechanism vulnerability that could allow an attacker to purge all devices without additional security options enabled and set a BCU key to lock the device.

Timeline

Published:August 29th, 2023 8:15 PM

Last modified:July 16th, 2026 5:16 AM

Added to KEV:July 15th, 2026

CVSS Scoring

CVSS v3: 7.5 (HIGH)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected Software

From NVD CPE configuration data

Vendors

knx

Products

connection_authorization

Weaknesses (CWE)

CWE-645

References & Reports

Advisories, patches, and third-party reports

Source: NIST NVD · Data may lag official sources by up to one minute