CVE-2023-4346

No ransomware group in this database is currently recorded as exploiting CVE-2023-4346.

CVE-2023-4346 affects KNX Association KNX Protocol Connection Authorization Option 1. KNX devices that use KNX Connection Authorization and support Option 1 are, depending on the implementation, vulnerable to being locked and users being unable to reset them to gain access to the device. The BCU key feature on the devices can be used to create a password for the device, but this password can often not be reset without entering the current password. If the device is configured to interface with a network, an attacker with access to that network could interface with the KNX installation, purge all devices without additional security options enabled, and set a BCU key, locking the device. Even if a device is not connected to a network, an attacker with physical access to the device could also exploit this vulnerability in the same way.

CVE-2023-4346 is rated HIGH with a CVSS base score of 7.5. EPSS puts the probability of exploitation in the next 30 days at 0.9%, higher than 56.5% of all scored vulnerabilities. It is listed in the CISA Known Exploited Vulnerabilities catalog, with a federal remediation deadline of 29 July 2026.

Apply the vendor patch for KNX Association KNX Protocol Connection Authorization Option 1 as the first priority, and treat any internet-facing instance as the most urgent. Because this vulnerability is associated with ransomware activity, also review whether the affected systems were reachable before patching, rather than assuming that patching alone closes the incident.