Security Resilience

CVE-2023-4346

Knx Connection Authorization

CISA KEVActive Exploitation
Published
29 August 2023
Modified
16 July 2026
KEV Added
15 July 2026
CVSS Score v3.1 7.5
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score 0.013 70th percentile
Risk Priority 84 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2023-4346 is a high-severity Overly Restrictive Account Lockout Mechanism (CWE-645) vulnerability in Knx Connection Authorization. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique LSASS Memory (T1003.001); ranked in the top 30% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.

EU & UK References

Vulnerability Data

KNX devices that use KNX Connection Authorization and support Option 1 are, depending on the implementation, vulnerable to being locked and users being unable to reset them to gain access to the device. The BCU key feature on the devices…

more

can be used to create a password for the device, but this password can often not be reset without entering the current password. If the device is configured to interface with a network, an attacker with access to that network could interface with the KNX installation, purge all devices without additional security options enabled, and set a BCU key, locking the device. Even if a device is not connected to a network, an attacker with physical access to the device could also exploit this vulnerability in the same way.

CWE(s)
CWE-645
KEV Date Added
15 July 2026

Related Threats

MITRE ATT&CK Enterprise Techniques

T1003.001 LSASS Memory Credential Access
Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS).
attack.mitre.org →
T1003.002 Security Account Manager Credential Access
Adversaries may attempt to extract credential material from the Security Account Manager (SAM) database either through in-memory techniques or through the Windows Registry where the SAM database is stored.
attack.mitre.org →
T1003.003 NTDS Credential Access
Adversaries may attempt to access or create a copy of the Active Directory domain database in order to steal credential information, as well as obtain other information about domain members such as devices, users, and access rights.
attack.mitre.org →
T1003.008 /etc/passwd and /etc/shadow Credential Access
Adversaries may attempt to dump the contents of <code>/etc/passwd</code> and <code>/etc/shadow</code> to enable offline password cracking.
attack.mitre.org →
T1005 Data from Local System Collection
Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.
attack.mitre.org →
T1007 System Service Discovery Discovery
Adversaries may try to gather information about registered local system services.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2025-5241Shared CWE-645
CVE-2024-1722Shared CWE-645
CVE-2025-31947Shared CWE-645
CVE-2026-25907Shared CWE-645
CVE-2026-53982Shared CWE-645
CVE-2024-37028Shared CWE-645

Affected Assets

knx
connection authorization
all versions

Mitigating Controls

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

DE.CM-03 partial match
blocks

Monitoring can detect resulting lockouts but does not prevent an overly restrictive mechanism.

PR.AA-01 partial match
blocks

Credential management policies directly govern lockout thresholds and reset procedures.

PR.AA-03 partial match
blocks

Authentication policies include lockout parameters that must not be overly restrictive.

PR.AA-05 partial match
blocks

Authorization policy definition and review encompass account lockout rules and exceptions.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.5.15 Access control partial match
degrades

Access control policy should define lockout thresholds and recovery procedures to avoid overly restrictive denial-of-service.

A.5.17 Authentication information partial match
degrades

Authentication information management includes setting lockout parameters that balance security against accidental lockouts.

A.5.18 Access rights partial match
degrades

Access rights administration must include procedures for unlocking accounts and reviewing lockout events.

A.7.11 Supporting utilities partial match
removes
A.8.26 Application security requirements partial match
removes
A.8.27 Secure system architecture and engineering principles partial match
removes

References