erroneo.us
Search all guides⌘K

Security Digest · Aug 24, 2023 · Vulnerability · Other

KNX CVE-2023-4346: Building Automation BCU Key Lockout

Attackers can wipe KNX building devices and lock owners out with their own BCU key. No patch; now in CISA KEV. Facilities teams: set BCU keys and isolate KNX.

Published By erroneo.us Security Desk · Updated 3 min read6 sources

Our verdict

Check exposure

Only buildings with KNX devices that have no BCU key set and a network path to the KNX bus are at risk, but there is no patch and a lockout can mean physically replacing devices.

Who must act: Owners, facility managers and integrators of KNX building automation (lighting, shutters, HVAC, sensors), especially where a KNX IP interface is reachable from the internet or a shared corporate network.

Who can relax: Organizations with no KNX installations, and sites where every device has a documented BCU key and the KNX network is isolated.

Affected
KNX devices using Connection Authorization Option 1 with no BCU key set, all versions
Fixed in
No software fix; the KNX Association's mitigation is to set and document a BCU key on every device
CVSS
7.5 (v3.1, CNA)
EPSS
1.3% (percentile 70)
CISA KEV
Yes, listed as known exploited
Exploitation
Exploited in the wild
Severity
High

What to do

  1. Ask facilities and your integrator whether any building uses KNX and where its IP interfaces sit on the network.
  2. Have the integrator set a BCU key on every device in finished and future projects, and hand the keys over to the building owner with the project documentation.
  3. Apply the KNX Secure Checklist to each installation.
  4. Take KNX IP interfaces off the internet, put the KNX network behind a firewall separate from business networks, and use a maintained VPN for remote access.
  5. Store ETS project files and BCU keys somewhere an attacker on the building network cannot reach.

How to check if you are affected or compromised

  • Sudden loss of control of switches, shutters or motion detectors, or devices that stop responding to ETS programming.
  • Devices that demand a BCU key or password nobody on your team set.
  • Firewall or flow logs showing internet or unexpected internal hosts talking to KNX IP gateways.

What happened#

On August 24, 2023, CISA published ICS advisory ICSA-23-236-01 for CVE-2023-4346. It is a design weakness in KNX, the building automation protocol widely used in Europe for lighting, blinds, heating and sensors. KNX devices that support Connection Authorization "Option 1" can be protected with a BCU key, a device password. On many devices, that key cannot be reset without knowing the current one.

An attacker who can reach the KNX installation, over a network or physically, can purge any device that has no extra security options. They can then set their own BCU key. The owner is locked out with no supported way to reset the device. The CVE record scores it CVSS 3.1 7.5 (High) for availability impact only. Felix Eberstaller of Limes Security reported it. The 2023 advisory already said CISA "has received reports of this vulnerability being actively exploited." On July 15, 2026, CISA added the CVE to the KEV catalog, with a federal deadline of July 29.

Who is affected#

Any KNX device using Connection Authorization Option 1 with no BCU key set is affected, in all versions. The flaw sits in how the standard's authorization is used, not in one manufacturer's code, so there is no vendor patch to install. That makes the at-risk population "installations where nobody set the key". According to inside.lighting, Alpha Strike Labs scans found more than 16,000 potentially vulnerable KNX systems exposed to the internet, concentrated in Germany, Austria and Switzerland.

Do you really need to act?#

For most software teams, no. This is operational technology, owned by facilities or an outside integrator. If your company owns or runs buildings with KNX, especially offices, hotels or sites in Europe, raise it with whoever manages them.

The attacks are real and disruptive. In a case reported in late 2021 (summarized from Dark Reading), a German engineering firm lost contact with hundreds of devices in an office building it had automated, including light switches, motion detectors and shutter controllers. About three-quarters of them were locked with the system's own BCU key, which the attacker had taken over. Staff controlled the lights by flipping central circuit breakers. Limes Security recovered the hijacked key from one bricked device's memory, which "required creative hacking". Limes says it has heard of similar KNX attacks since, including another European engineering firm locked out the same way.

The impact is availability, not data theft. Recovery, though, can mean extracting keys from hardware or replacing devices. Since no fix will arrive, the only defenses are setting keys and controlling network access.

What to do now#

  1. Find out whether your buildings use KNX and where the KNX IP interfaces or routers connect: the internet, the corporate LAN, or an isolated network.
  2. Have the integrator set a BCU key on every device. The KNX Association recommends users "always set the BCU Key in every KNX Project that is already finished and will be commissioned in the future," and hand the key to the building owner as part of the project documentation.
  3. Apply the KNX Secure Checklist the association points to in the CISA advisory.
  4. Follow CISA's baseline: no internet exposure for control systems, a firewall between KNX and business networks, and a maintained VPN for remote access.
  5. Keep ETS project files and BCU keys in a secure location off the building network. Losing them can lock you out of your own installation.

How to tell if you were hit#

A lockout is loud. Switches, shutters or sensors stop responding, and ETS can no longer program devices because they now require a key nobody on your side set. Before that happens, check firewall and flow logs for internet hosts, or unexpected internal machines, talking to your KNX IP gateways. If you are locked out, preserve a locked device for analysis, involve your integrator and the device manufacturer, and report the incident to CISA or your national CERT.

Timeline#

  • — A German engineering firm contacts Limes Security after being locked out of a client's KNX system.
  • — CISA publishes ICSA-23-236-01, noting reports of active exploitation.
  • — The CVE record for CVE-2023-4346 is published (NVD).
  • — CISA adds CVE-2023-4346 to KEV, with a federal deadline of July 29.

Vulnerability records

  • CVE-2023-4346 · KEV 2026-07-15 · KNX devices that use KNX Connection Authorization and support Option 1 are, depending on the implementation, vulnerable to being locked and users being unable…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

  1. CISA — ICS Advisory ICSA-23-236-01: KNX Protocol cisa.gov
  2. CVE record — CVE-2023-4346 cve.org
  3. NVD — CVE-2023-4346 nvd.nist.gov
  4. CISA — Known Exploited Vulnerabilities: CVE-2023-4346 cisa.gov
  5. Science of Security VO (summary of Dark Reading) — Lights Out: Cyberattacks Shut Down Building Automation Systems sos-vo.org
  6. inside.lighting — US issues cybersecurity warning on building automation protocol (Jul 22, 2026) inside.lighting