Summary
CVE-2023-4346 is a security vulnerability affecting certain KNX devices that utilize the KNX Connection Authorization feature and support "Option 1." The vulnerability exists because the Bus Coupling Unit (BCU) key feature allows for the creation of a device password that, depending on the implementation, cannot be reset without already knowing the current password. This is significant because it allows an attacker to effectively "brick" or permanently lock a device, preventing authorized users from accessing or managing it.
Exploitation
- Active Exploitation: There are no widespread reports of active exploitation by threat actors or ransomware campaigns in the wild.
- Proof-of-Concept/Exploit Tools: Publicly available exploit tools or dedicated PoCs are not widely documented for this vulnerability, as it primarily involves the manipulation of device configuration logic rather than traditional remote code execution.
- Attack Prerequisites:
-
Physical Access: The vulnerability can be exploited by an attacker with physical access to the device.
-
Network Access: Depending on the network implementation, it may also be exploitable via the network if the attacker can reach the KNX interface.
-
Authentication: No prior authentication to the device is required to trigger the lockout condition.
-
User Interaction: No interaction from the legitimate user is required.
Affected Products & Patches
- Affected Products: KNX devices that support the KNX Connection Authorization feature and specifically implement "Option 1" regarding BCU key/password management.
- Patch/Hotfix Availability: There is no universal "patch" for the protocol itself. Remediation relies on individual vendors issuing firmware updates to change how their specific device handles password resets.
- Mitigations:
- Consult the official guidance provided by the KNX Association and specific device manufacturers.
- Ensure that devices are secured behind firewalls or in segmented networks to limit unauthorized access to the KNX bus interface.
- Restrict physical access to critical infrastructure components to prevent tampering.
Impact
- Access/Capability: Successful exploitation results in a permanent Denial of Service (DoS) for the affected device. The owner is locked out of the system, and because the password cannot be reset, the device may become unusable or require specialized factory-level recovery that may not be available to the end-user.
- Business Risk: For internet-facing or networked building automation systems, this vulnerability poses a significant risk to operational continuity. If an attacker locks out critical controls (such as lighting, HVAC, or security systems), the business could face service disruptions, safety risks, and costly manual hardware replacement or professional recovery efforts.