CVE-2023-4346Active Exploitation(knx / connection_authorization)

MEDIUMCVSS 7.5 · HIGHCISA KEV

Exploitation observed; activity peaked at 10 mentions and remains active

Immediate actions

Patch knx connection_authorization systems immediately
Assume compromise if assets are exposed

Recommended action window: Immediate (within 24h)

NVD description

KNX devices that use KNX Connection Authorization and support Option 1 are, depending on the implementation, vulnerable to being locked and users being unable to reset them to gain access to the device. The BCU key feature on the devices can be used to create a password for the device, but this password can often not be reset without entering the current password. If the device is configured to interface with a network, an attacker with access to that network could interface with the KNX installation, purge all devices without additional security options enabled, and set a BCU key, locking the device. Even if a device is not connected to a network, an attacker with physical access to the device could also exploit this vulnerability in the same way.

knx CVEs Back to dashboard

4.0/ 10 priority

Sources & remediation

Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2026-07-29. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Vendor / third-party advisories

Other references

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-4346

Weakness type (CWE)

CWE-645

Priority

MEDIUM

Exploitation

ACTIVE

PoC

NONE

Patch

AVAILABLE

Momentum

DECLINING

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

connection_authorization

Threat summary

Active exploitation appears in 13 classified signals
Patch or workaround signal is available
15 mentions across 5 observed days
Momentum state: declining

What's happening

Active exploitation reported across 13 signals
Patch or workaround mentioned in 4 signals
Technical details provided in 6 signals
Disclosure: 1 classified signal
Peaked 3d ago at 10 mentions (2026-07-16); latest day: 1
15 total mentions across 5 days

Affected systems

Vendors

knx

Products

connection_authorization

1 version affected across 1 product

Deep dive

Activity timeline15 mentions / 5d

Signal classification3 categories

Active Exploitation

1386.7%

Patch

16.7%

Disclosure

16.7%

Referenced assets19 URLs

By indicator

Classification over time

Date	Total	Labels

2026-07-15	2	Active Exploitation1Patch1
2026-07-16	10	Active Exploitation9Disclosure1
2026-07-17	1	Active Exploitation1
2026-07-19	1	Active Exploitation1
2026-09-16	1	Active Exploitation1

Full discourse15 posts

CISA Cyber@CISACyber91d
Active Exploitation
🛡️We added KNX Protocol Connection Authorization Option 1 vulnerability CVE-2023-4346 & Oracle E-Business Suite vulnerability CVE-2026-46817 to our KEV Catalog. Visit https://go.dhs.gov/Z3Q & apply mitigations to protect your org from cyberattacks. #Cybersecurity #InfoSec https://t.co/7NK6j6AOlk
Post summary
The DHS statement announces the inclusion of CVE-2023-4346 and CVE-2026-46817 in its KEV catalog, confirming active exploitation and encouraging mitigations.
1902437.0K
302.1K followersView on X
piyokango@piyokango90d
Active Exploitation
米国CISAが悪用を確認した脆弱性 #KEV をカタログに追加しました。（7/15追加） CVE-2023-4346 KNX Association KNX Protocol Connection Authorization Option 1 Overly Restrictive Account Lockout Mechanism Vulnerability ✅概要・深刻度：重要 7.5 (CVSS Base) / ICS-CERT (CNA) ・種別：過度に制限されたアカウントロックアウトメカニズム (CWE-645) ・CVSS:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H KNX Connection Authorization の Option 1 をサポートする KNX デバイスに存在する、過度に制限されたアカウントロックアウトメカニズムの脆弱性です。攻撃者がネットワーク接続された KNX 設備、または物理アクセス可能な KNX デバイスに対して BCU キーを設定することで、正規ユーザーがデバイスへアクセスできない状態にされる可能性があります。悪用により、対象デバイスがロックされ、復旧や再設定に支障が生じる可能性があります。 ✅ChatGPTによる脆弱性評価・国内影響度：中・悪用難易度：中 ✅CISA 評価・攻撃自動化：自動化は可能・技術的影響：部分的・BOD 26-04 対処期限（露出あり）：2026年7月29日・BOD 26-04 対処期限（露出なし）：2026年7月29日 ✅攻撃前提条件・KNX Connection Authorization の Option 1 をサポートする KNX デバイスを使用している・BCU キーが未設定、または追加のセキュリティオプションが有効化されていない・攻撃者が KNX 設備に接続されたネットワークへアクセスできる・ネットワーク接続されていない場合、攻撃者が対象デバイスへ物理アクセスできる・開発者が推奨するワークアラウンドまたは適切なセキュリティ設定が適用されていない ✅悪用時影響・攻撃者に BCU キーを設定される可能性がある・正規ユーザーがデバイスへアクセスできなくなる可能性がある・デバイスをリセットまたは復旧できない状態にされる可能性がある・KNX 設備の可用性に高い影響が生じる・設備制御や運用に支障が生じる可能性がある ✅悪用事例等に関する公開情報・PoC/Exploit：公開情報確認できず・ITW：未確認 ✅関連情報・https://nvd.nist.gov/vuln/detail/CVE-2023-4346 ・https://www.cisa.gov/news-events/ics-advisories/icsa-23-236-01 ・https://github.com/cisagov/vulnrichment/blob/develop/2023/4xxx/CVE-2023-4346.json ・https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-4346 CVE-2026-46817 Oracle E-Business Suite Improper Privilege Management Vulnerability ✅概要・深刻度：緊急 9.8 (CVSS Base) / Oracle (CNA) ・種別：重要な機能に対する認証の欠如 (CWE-306) / 不適切な認証 (CWE-287) / 権限管理の不適切な制御 (CWE-269) ・CVSS:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Oracle E-Business Suite の Oracle Payments 製品、File Transmission コンポーネントに存在する脆弱性です。影響を受けるバージョンは 12.2.3 から 12.2.15 であり、HTTP 経由でネットワークアクセス可能な未認証の攻撃者に悪用される可能性があります。悪用に成功した場合、Oracle Payments を乗っ取られる可能性があります。 ✅ChatGPTによる脆弱性評価・国内影響度：高・悪用難易度：低 ✅CISA 評価・攻撃自動化：自動化は可能・技術的影響：完全制御・BOD 26-04 対処期限（露出あり）：2026年7月18日・BOD 26-04 対処期限（露出なし）：2026年7月29日 ✅攻撃前提条件・Oracle E-Business Suite 12.2.3 から 12.2.15 を使用している・Oracle Payments の File Transmission コンポーネントが影響を受ける状態である・攻撃者が HTTP 経由で対象環境へネットワークアクセスできる・攻撃者は認証情報を必要としない・Oracle May 2026 Critical Security Patch Update、または後続の修正が適用されていない ✅悪用時影響・Oracle Payments を乗っ取られる可能性がある・機密性、完全性、可用性に高い影響が生じる・Oracle E-Business Suite 上の決済関連データへ不正アクセスされる可能性がある・決済処理やファイル伝送機能を不正操作される可能性がある・Oracle E-Business Suite 環境を起点に追加侵害へつなげられる可能性がある ✅悪用事例等に関する公開情報・PoC/Exploit：公開情報確認できず・ITW：確認済み（Defused）・概要：Defused は、Oracle E-Business Suite のデコイ環境で、2026年6月27日に CVE-2026-46817 の in-the-wild 悪用として、単一送信元から6回の未認証ファイル読み取り試行を観測したと公表 ✅関連情報・https://nvd.nist.gov/vuln/detail/CVE-2026-46817 ・https://www.oracle.com/security-alerts/cspumay2026.html ・https://github.com/cisagov/vulnrichment/blob/develop/2026/46xxx/CVE-2026-46817.json ・https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-46817 ・https://defusedcyber.com/exploited/cve-2026-46817-oracle-e-business-suite https://www.cisa.gov/news-events/alerts/2026/07/15/cisa-adds-two-known-exploited-vulnerabilities-catalog #vulnerability
Post summary
CISA added two CVEs to the known exploited catalog, noting that CVE‑2026‑46817 has observed in‑the‑wild exploitation, while technical details and patch information are also provided for both vulnerabilities.
0101547.0K
44.2K followersView on X
CCB Alert@CCBalert90d
Active Exploitation
Warning: #CISA added CVE-2023-4346 (#KNX Protocol, CVSS 7.5) to its KEV catalog. Actively #exploited "KNXlock" attacks permanently lock building automation devices (lighting, heating, shutters) with no reset possible. More info: https://ccb.belgium.be/advisories/warning-cisa-added-actively-exploited-vulnerability-cve-2023-4346-knx-protocol-its-kev. #Patch #Patch #Patch
Post summary
CVE-2023-4346 is actively exploited in the wild, causing permanent lockouts on KNX devices, and a patch has been released.
12021543
7.2K followersView on X
Daily CyberSecurity@Daily_CyberSec91d
Active Exploitation
CISA KEV catalog now lists CVE-2026-46817, a critical Oracle E-Business Suite flaw, and CVE-2023-4346 in KNX devices. Both are exploited in the wild. #CISA #KEV #CVE202646817 #Oracle #KNX http://securityonline.info/cisa-kev-cve-2026-46817-cve-2023-4346/
Post summary
The tweet reports that CVE-2026-46817 (Oracle) and CVE-2023-4346 (KNX) have been added to CISA's KEV catalog and are already being exploited in the wild.
00020489
12.9K followersView on X
Cyphere@TheCyphere29d
Active Exploitation
CISA Adds Two Known Exploited Vulnerabilities to Catalog CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2023-4346 KNX Association KNX Protocol Connection Authorization Option @CISACyber
Post summary
CISA added CVE-2023-4346 to the Known Exploited Vulnerabilities Catalog based on evidence of active exploitation. The text does not provide PoC, exploit code, remediation, or detailed technical vulnerability information.
1000069
1.5K followersView on X
isogashii@cyber_risk_sec87d
Active Exploitation
【KEV・ビル設備】KNX CVE-2023-4346 対象：KNX Association KNXプロトコル（ビル管理・空調・照明制御）状況：CISA KEV登録済み（7/15追加）内容：アカウントロックアウト機構が過度に制限的な設計対応：BAS/ビル設備側の資産棚卸しは情シス管轄外になりがち。 https://www.cisa.gov/news-events/alerts/2026/07/15/cisa-adds-two-known-exploited-vulnerabilities-catalog
Post summary
CISA has added KNX CVE‑2023‑4346 to its Known Exploited Vulnerabilities catalog, but the announcement lacks any PoC, exploit code, patch information, or detailed technical description of the flaw.
0001082
120 followersView on X
キタきつね@foxbook91d
Active Exploitation
CISAが既知の悪用された脆弱性2件をカタログに追加 CISA Adds Two Known Exploited Vulnerabilities to Catalog #CISA (Jul 15) CVE-2023-4346 KNXアソシエーション KNXプロトコル接続認証オプション1 過度に制限的なアカウントロックアウトメカニズムの脆弱性 CVE-2026-46817 Oracle E-Business Suiteにおける不適切な権限管理の脆弱性 https://www.cisa.gov/news-events/alerts/2026/07/15/cisa-adds-two-known-exploited-vulnerabilities-catalog
Post summary
CISA reports that CVE-2023-4346 and CVE-2026-46817 are actively exploited in the wild, but offers no PoC, exploit tool, or patch details.
00001282
4.9K followersView on X
Israel@f1tym190d
Active Exploitation
CISA added CVE-2023-4346 and CVE-2026-46817 to its KEV catalog, both actively exploited vulnerabilities affecting KNX devices and Oracle E-Business Suite. https://ift.tt/QROCxMI
Post summary
CISA has added CVE-2023-4346 and CVE-2026-46817 to its KEV catalog, labeling them as actively exploited vulnerabilities that impact KNX devices and Oracle E‑Business Suite.
0000085
1.0K followersView on X
PCMedicalist@PCMedicalist90d
Disclosure
🟦 PCMedicalist Signal · Jul 16 • CVE-2026-46817 — Oracle E-Business Suite Improper Privileg… — CISA KEV Vulns • CVE-2023-4346 — KNX Association KNX Protocol Connection Au… — CISA KEV Vulns #VulnerabilityIntelligence SecOps · Blue Team · Autonomous Builds https://t.co/znea62aalJ
Post summary
The tweet lists two CVEs with brief technical labels and identifies them as CISA KEV vulnerabilities, functioning as a disclosure update without any exploit, PoC, active exploitation, or patch information.
0000060
119 followersView on X
Security Arsenal, LLC@SecurityAr5840991d
Active Exploitation
🔒 #CyberSecurity CVE-2026-46817 & CVE-2023-4346: CISA KEV Alert — Oracle EBS & KNX Protocol Acti… "On July 15, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added two…" 🔗 https://securityarsenal.com/blog/cve-2026-46817-and-cve-2023-4346-cisa-kev-alert-oracle-ebs-and-knx-protocol-active-exploitation #CyberSecurity #ThreatIntel #cve #zeroday #patchtuesday
Post summary
The tweet announces a CISA KEV alert for CVE‑2026‑46817 and CVE‑2023‑4346, indicating these vulnerabilities are being actively exploited in the wild.
00000101
19 followersView on X
SecNews@SecNews_GR91d
Active Exploitation
CVE-2023-4346: Ενεργή εκμετάλλευση KNX ευπάθειας σε κτιριακό αυτοματισμό https://secn.ws/Eoyl1d
Post summary
The post indicates that CVE-2023-4346 is being actively exploited in KNX building automation systems.
0000098
7.0K followersView on X
SecNews@SecNews_GR91d
Active Exploitation
CVE-2023-4346: Ενεργή εκμετάλλευση KNX ευπάθειας σε κτιριακό αυτοματισμό https://secn.ws/CMenEq
Post summary
The text claims that CVE-2023-4346 is actively exploited in KNX building‑automation systems, yet it offers no technical details or mitigation guidance.
0000077
7.0K followersView on X
Security Arsenal, LLC@SecurityAr5840991d
Active Exploitation
🔒 #CyberSecurity CVE-2023-4346: Active Exploitation of KNX Protocol Lockout Mechanism – Defense … "As of July 15, 2026, CISA has added CVE-2023-4346 to the Known Exploited…" 🔗 https://securityarsenal.com/blog/cve-2023-4346-active-exploitation-of-knx-protocol-lockout-mechanism-defense-and-detection #CyberSecurity #ThreatIntel #cve20234346 #critical #cisakev
Post summary
CVE‑2023‑4346 is actively exploited, as confirmed by CISA’s inclusion in the Known Exploited Vulnerabilities list. The article describes the vulnerability in the KNX protocol lockout mechanism but no PoC, patch, or exploit code is provided.
0000065
19 followersView on X
The Circuitry@thecircuitry_91d
Active Exploitation
Breaking: CISA adds KNX Protocol CVE-2023-4346 to its Known Exploited Vulnerabilities catalog. New York pauses high power data centers while Stripe bids for PayPal and Volkswagen unveils its electric ID. Cross. Watch the verified rundown now. https://t.co/CQn7QZxtRR
Post summary
CISA has added CVE-2023-4346 to its Known Exploited Vulnerabilities catalog, indicating that the KNX Protocol vulnerability is actively exploited in the wild, yet the post provides no PoC, exploit code, patch, or detailed technical info.
0000059
26 followersView on X
The Circuitry@thecircuitry_91d
Patch
CISA added KNX Protocol CVE-2023-4346 to the KEV catalog. The account lockout flaw could let attackers purge devices and lock them with a BCU key. Federal agencies must remediate by July 29. The whole story: https://thecircuitry.to/article/cisa-adds-knx-protocol-cve-2023-4346-to-kev-catalog-mrmdk180 https://t.co/SFjEWczvOC
Post summary
CISA added CVE‑2023‑4346 to the KEV catalog, noting that an account‑lockout flaw can purge and lock KNX devices; federal agencies are required to remediate the vulnerability by July 29.
0000049
26 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	knx	connection_authorization	-	-	-

Explore more

Back to dashboard knx CVEs connection_authorization vulnerabilities

What researchers are saying

CVE-2023-4346

piyokango[verified]@piyokangoActive Exploitation

CISA added two CVEs to the known exploited catalog, noting that CVE‑2026‑46817 has observed in‑the‑wild exploitation, while technical details and patch information are also provided for both vulnerabilities.

キタきつね[verified]@foxbookActive Exploitation

CISA reports that CVE-2023-4346 and CVE-2026-46817 are actively exploited in the wild, but offers no PoC, exploit tool, or patch details.

Israel[verified]@f1tym1Active Exploitation

CISA has added CVE-2023-4346 and CVE-2026-46817 to its KEV catalog, labeling them as actively exploited vulnerabilities that impact KNX devices and Oracle E‑Business Suite.

PCMedicalist[verified]@PCMedicalistDisclosure

The tweet lists two CVEs with brief technical labels and identifies them as CISA KEV vulnerabilities, functioning as a disclosure update without any exploit, PoC, active exploitation, or patch information.

Security Arsenal, LLC[verified]@SecurityAr58409Active Exploitation

The tweet announces a CISA KEV alert for CVE‑2026‑46817 and CVE‑2023‑4346, indicating these vulnerabilities are being actively exploited in the wild.

SecNews[verified]@SecNews_GRActive Exploitation

The post indicates that CVE-2023-4346 is being actively exploited in KNX building automation systems.

SecNews[verified]@SecNews_GRActive Exploitation

The text claims that CVE-2023-4346 is actively exploited in KNX building‑automation systems, yet it offers no technical details or mitigation guidance.

Security Arsenal, LLC[verified]@SecurityAr58409Active Exploitation

CVE‑2023‑4346 is actively exploited, as confirmed by CISA’s inclusion in the Known Exploited Vulnerabilities list. The article describes the vulnerability in the KNX protocol lockout mechanism but no PoC, patch, or exploit code is provided.