SB2023082457 - Denial of service in KNX devices

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2023082457

SB2023082457 - Denial of service in KNX devices

Published: August 24, 2023 Updated: July 17, 2026

Security Bulletin ID SB2023082457
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Overly restrictive account lockout mechanism (CVE-ID: CVE-2023-4346)

CWE-ID: CWE-645 - Overly Restrictive Account Lockout Mechanism

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:A/U:Green


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an overly restrictive account lockout mechanism in KNX Connection Authorization Option 1 handling when interfacing with the KNX installation to purge devices and set a BCU key. A remote attacker can purge devices without additional security options enabled and set a BCU key to cause a denial of service.

Devices are affected when no BCU key is currently set, and exploitation may leave users unable to regain access to the device or reset it.


Remediation

Install update from vendor's website.

References