KNX building automation lockout flaw CVE-2023-4346 (KNXlock) used in attacks; mitigations available
Attackers can disable and lock unprotected KNX home and building automation devices. CVE-2023-4346 has no published patched version identified. Ask your installer to check BCU key protection, keep the key safely documented and remove direct internet access.
If your home or building uses KNX automation, ask its installer to check BCU key protection on supporting devices and give you a securely stored copy of the key with the project documentation. Have them remove direct internet access and isolate the automation network. If devices are already locked, contact the installer and device manufacturer: reset and recovery options vary.
What’s happening
CVE-2023-4346 affects KNX building automation devices using Connection Authorization Option 1 without a BCU key set. An attacker with access to the installation's network, or physical access, can leave devices unusable and their owners unable to reset them. KNXlock attacks were documented years before CISA added the flaw to its exploited-vulnerabilities catalogue on 15 July 2026. Limes Security described one building losing normal control of hundreds of components, including lighting and shutters; it recovered access and the building returned to operation. That recovery did not fix the underlying weakness. As at 3 November 2026, the reviewed guidance identifies mitigations but no patched version. KNX recommends setting and documenting the BCU key, while CISA recommends preventing direct internet access and isolating control networks. CISA does not identify victims or attack dates behind its July listing.
- What
- Flaw
- Affects
- KNX home and building automation devices using Connection Authorization Option 1
- Affected
- KNX devices using Connection Authorization Option 1 Style in which no BCU Key is currently set: all versions
- Fixed in
- No fix yet
- Since
- 15 July 2026
- Closed
- 15 July 2026
Timeline
- CISA added
CISA added CVE-2023-4346 to its Known Exploited Vulnerabilities catalogue, with a federal remediation deadline of 29 July. Its entry calls for vendor mitigations and records ransomware use as unknown.
- Update
Limes Security reported that KNXlock attacks, first reported by the company in late 2021, were still being reported in 2023. In one case brought to it in October 2021, three quarters of several hundred building-control components stopped working; Limes recovered access and the building was restored.
- Made publicNo fix yet
CISA published its CVE-2023-4346 advisory and reported active exploitation. It identified KNX devices using Connection Authorization Option 1 with no BCU key set, and relayed KNX Association's recommendation to set and document that key.
Sources
- BCU KeysKNX Association · 20 Feb 2025
- KNX Protocol — ICSA-23-236-01 (official CSAF advisory)CISA · 24 Aug 2023
- KNXlock – an attack campaign against KNX-based building automation systemsLimes Security · 25 Aug 2023
- Known Exploited Vulnerabilities catalogue — 3 November 2026 editionCISA · 3 Nov 2026
- U.S. CISA adds KNX Association KNX Protocol Connection Authorization Option 1 and Oracle flaws to its Known Exploited Vulnerabilities catalogSecurity Affairs · 17 July 2026