CVE-2023-4346

CVE-2023-4346 is a high-severity vulnerability in Knx Connection Authorization with a CVSS 3.x base score of 7.5. It is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, confirming it has been exploited in the wild (added 2026-07-15). The underlying weakness is classified as CWE-645.

Key facts

Description

KNX devices that use KNX Connection Authorization and support Option 1 are, depending on the implementation, vulnerable to being locked and users being unable to reset them to gain access to the device. The BCU key feature on the devices can be used to create a password for the device, but this password can often not be reset without entering the current password. If the device is configured to interface with a network, an attacker with access to that network could interface with the KNX installation, purge all devices without additional security options enabled, and set a BCU key, locking the device. Even if a device is not connected to a network, an attacker with physical access to the device could also exploit this vulnerability in the same way.

Frequently asked questions

What is CVE-2023-4346?
KNX devices that use KNX Connection Authorization and support Option 1 are, depending on the implementation, vulnerable to being locked and users being unable to reset them to gain access to the device. The BCU key feature on the devices can be used to create a password for the device, but this password can often not be reset without entering the current password. If the device is configured to interface with a network, an attacker with access to that network could interface with the KNX installation, purge all devices without additional security options enabled, and set a BCU key, locking the device. Even if a device is not connected to a network, an attacker with physical access to the device could also exploit this vulnerability in the same way.
How severe is CVE-2023-4346?
CVE-2023-4346 has a CVSS 3.x base score of 7.5, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.
Is CVE-2023-4346 being actively exploited?
Yes. CVE-2023-4346 is on CISA's Known Exploited Vulnerabilities (KEV) catalog, added on 2026-07-15, which means active exploitation has been confirmed. It should be prioritised for remediation.
What products are affected by CVE-2023-4346?
CVE-2023-4346 affects Knx Connection Authorization. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2023-4346?
Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Because this CVE is known to be actively exploited, treat remediation as urgent — CISA KEV typically sets a short remediation deadline.
When was CVE-2023-4346 published?
CVE-2023-4346 was published on 2023-08-29 and last updated on 2026-07-16.

References

Affected products (1)

Other CWE-645 vulnerabilities

Browse all CWE-645 vulnerabilities →