CVE-2023-4346: KNX Connection Authorization Account-Lockout DoS

CVE-2023-4346 is an overly restrictive account-lockout mechanism in the KNX Connection Authorization Option 1 protocol used by building-automation devices: an attacker with network or bus access can set a BCU key on a device that has none configured, and because that key frequently cannot be reset without already knowing it, the device's legitimate owner can be permanently locked out of configuring or resetting it.

CVE-2023-4346 is an overly restrictive account-lockout mechanism (CWE-645) affecting KNX devices that use KNX Connection Authorization Option 1 style and currently have no BCU (Bus Coupling Unit) key set. KNX is a widely deployed building-automation protocol used to network lighting, HVAC, blinds, and access-control components, predominantly in Europe. An attacker who can reach a device over the KNX bus or network can set a BCU key on it; because many implementations provide no way to clear that key without first supplying it, the device's legitimate operator can be permanently denied the ability to reconfigure or reset it — a lasting denial-of-service against the building-automation installation rather than data theft (CISA ICS Advisory ICSA-23-236-01).

NVD's own analysis scores this CVSS v3.1 7.5 (HIGH) as a Primary (NVD-confirmed) metric, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H — network-reachable, low attack complexity, no privileges or user interaction required, with high impact to availability only (no confidentiality or integrity loss, consistent with a lockout rather than a data-exposure bug) (NVD).

The CISA ICS advisory states "CISA has received reports of this vulnerability being actively exploited" and lists the KNX Association as the vendor, with impact concentrated in the Critical Manufacturing sector and deployments primarily in Europe (CISA ICS Advisory ICSA-23-236-01). CISA added CVE-2023-4346 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-07-15 with a required-action due date of 2026-07-29 (catalog version 2026.10.28, confirmed live this run); the catalog entry lists known ransomware-campaign use as "Unknown" (CISA KEV catalog).

KNX Association's own guidance is to set a BCU key on every project before deployment and to follow the KNX Secure Checklist; CISA additionally recommends restricting KNX device network exposure, keeping bus controllers off the public Internet, isolating control systems behind firewalls, and using VPNs for any required remote access rather than exposing the bus directly (CISA ICS Advisory ICSA-23-236-01).

As of 2026-10-28, FIRST scores the probability of exploitation at 0.01363 (71.683th percentile) — low in absolute terms but above the median, consistent with a niche building-automation protocol that is nonetheless actively probed given the KEV listing (FIRST EPSS). Because exploitation permanently denies configuration access rather than exposing data, the priority for any KNX installation using Connection Authorization Option 1 is to confirm a BCU key is already set on every device and that bus access is restricted to trusted installers.

• An attacker with network or bus access can set a BCU key on a KNX device with Connection Authorization Option 1 that has none configured, permanently locking the legitimate owner out because the key often cannot be reset without already knowing it. — CISA ICS Advisory ICSA-23-236-01
• CVSS v3.1 base score is 7.5 (HIGH), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, an NVD Primary (NVD-confirmed) metric. — NVD
• CISA states it has received reports of active exploitation; impact concentrated in the Critical Manufacturing sector, deployments primarily in Europe. — CISA ICS Advisory ICSA-23-236-01
• Added to the CISA KEV catalog on 2026-07-15, due date 2026-07-29 (catalog version 2026.10.28); known ransomware-campaign use listed as Unknown. — CISA KEV catalog
• EPSS score is 0.01363 (71.683th percentile) as of 2026-10-28. — FIRST EPSS