KNX CVE-2023-4346: Building Automation BCU Key Lockout
Only buildings with KNX devices that have no BCU key set and a network path to the KNX bus are at risk, but there is no patch and a lockout can mean physically replacing devices.
Must act: Owners, facility managers and integrators of KNX building automation (lighting, shutters, HVAC, sensors), especially where a KNX IP interface is reachable from the internet or a shared corporate network.
Can relax: Organizations with no KNX installations, and sites where every device has a documented BCU key and the KNX network is isolated.
- Ask facilities and your integrator whether any building uses KNX and where its IP interfaces sit on the network.
- Have the integrator set a BCU key on every device in finished and future projects, and hand the keys over to the building owner with the project documentation.
- Apply the KNX Secure Checklist to each installation.