EXPOSURES › CVE-2023-4346
CVE-2023-4346
HIGH ⌖ ON CISA KEV · EXPLOITEDKNX protocol devices vulnerable to account lockout bypass
KNX Association's KNX Protocol Connection Authorization Option 1 has an overly restrictive account lockout mechanism that can be exploited to purge devices and lock them, posing a high risk to DIB systems.
Shame score — Overly restrictive lockout mechanism allows unauthorized access and potential data loss or device control.
▸ RECOMMENDED ACTION Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
KNX Association KNX Protocol Connection Authorization Option 1 contains an overly restrictive account lockout mechanism vulnerability that could allow an attacker to purge all devices without additional security options enabled and set a BCU key to lock the device.