{"id":"knx-knxlock-device-lockout-jul-2026","category":"patch","status":"closed","title":"KNX building automation lockout flaw CVE-2023-4346 (KNXlock) used in attacks; mitigations available","tldr":"Attackers can disable and lock unprotected KNX home and building automation devices. CVE-2023-4346 has no published patched version identified. Ask your installer to check BCU key protection, keep the key safely documented and remove direct internet access.","summary":"CVE-2023-4346 affects KNX building automation devices using Connection Authorization Option 1 without a BCU key set. An attacker with access to the installation's network, or physical access, can leave devices unusable and their owners unable to reset them. KNXlock attacks were documented years before CISA added the flaw to its exploited-vulnerabilities catalogue on 15 July 2026. Limes Security described one building losing normal control of hundreds of components, including lighting and shutters; it recovered access and the building returned to operation. That recovery did not fix the underlying weakness. As at 3 November 2026, the reviewed guidance identifies mitigations but no patched version. KNX recommends setting and documenting the BCU key, while CISA recommends preventing direct internet access and isolating control networks. CISA does not identify victims or attack dates behind its July listing.","action":"If your home or building uses KNX automation, ask its installer to check BCU key protection on supporting devices and give you a securely stored copy of the key with the project documentation. Have them remove direct internet access and isolate the automation network. If devices are already locked, contact the installer and device manufacturer: reset and recovery options vary.","product":"KNX home and building automation devices using Connection Authorization Option 1","audience":"both","severity":"high","patch":"none","exploited":true,"cves":["CVE-2023-4346"],"tags":["knx","knxlock","smart-home","building-automation","device-lockout","actively-exploited"],"affected":["KNX devices using Connection Authorization Option 1 Style in which no BCU Key is currently set: all versions"],"fixed":[],"matches":[],"sources":[{"kind":"advisory","title":"BCU Keys","url":"https://support.knx.org/hc/en-us/articles/13433094464274-BCU-Keys","by":"KNX Association","date":"2025-02-20"},{"kind":"advisory","title":"KNX Protocol — ICSA-23-236-01 (official CSAF advisory)","url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2023/icsa-23-236-01.json","by":"CISA","date":"2023-08-24"},{"kind":"research","title":"KNXlock – an attack campaign against KNX-based building automation systems","url":"https://limessecurity.com/en/knxlock/","by":"Limes Security","date":"2023-08-25"},{"kind":"advisory","title":"Known Exploited Vulnerabilities catalogue — 3 November 2026 edition","url":"https://raw.githubusercontent.com/cisagov/kev-data/develop/known_exploited_vulnerabilities.json","by":"CISA","date":"2026-11-03"},{"kind":"news","title":"U.S. CISA adds KNX Association KNX Protocol Connection Authorization Option 1 and Oracle flaws to its Known Exploited Vulnerabilities catalog","url":"https://securityaffairs.com/195516/security/u-s-cisa-adds-knx-association-knx-protocol-connection-authorization-option-1-and-oracle-flaws-to-its-known-exploited-vulnerabilities-catalog.html","by":"Security Affairs","date":"2026-07-17"}],"started":"2026-07-15","closed":"2026-07-15","created":"2026-11-03T22:16:50.900Z","updated":"2026-11-03T22:16:50.900Z","cve_notes":[{"cve":"CVE-2023-4346","name":"Device lockout in KNX Connection Authorization Option 1","what":"An overly restrictive lockout mechanism in KNX Connection Authorization Option 1 can let an attacker with network or physical access disable unprotected devices and lock out their owners, potentially without a reset option.","severity":"high","cvss":7.5}],"timeline":[{"at":"2026-07-15","added":"2026-11-03T22:11:23.504Z","kind":"cisa-added","text":"CISA added CVE-2023-4346 to its Known Exploited Vulnerabilities catalogue, with a federal remediation deadline of 29 July. Its entry calls for vendor mitigations and records ransomware use as unknown.","url":"https://raw.githubusercontent.com/cisagov/kev-data/develop/known_exploited_vulnerabilities.json","by":"CISA","patch":null},{"at":"2023-08-25","added":"2026-11-03T22:11:23.504Z","kind":"other","text":"Limes Security reported that KNXlock attacks, first reported by the company in late 2021, were still being reported in 2023. In one case brought to it in October 2021, three quarters of several hundred building-control components stopped working; Limes recovered access and the building was restored.","url":"https://limessecurity.com/en/knxlock/","by":"Limes Security","patch":null},{"at":"2023-08-24","added":"2026-11-03T22:11:23.504Z","kind":"disclosed","text":"CISA published its CVE-2023-4346 advisory and reported active exploitation. It identified KNX devices using Connection Authorization Option 1 with no BCU key set, and relayed KNX Association's recommendation to set and document that key.","url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2023/icsa-23-236-01.json","by":"CISA","patch":"none"}],"url":"https://hard.fyi/live/knx-knxlock-device-lockout-jul-2026/","json":"https://hard.fyi/api/live?id=knx-knxlock-device-lockout-jul-2026"}