KNX Smart Building Protocol Vulnerability CVE-2023-4346

active exploitation confirmed

The project involves addressing a critical vulnerability in the KNX smart building protocol, specifically the BCU key feature, which allows attackers to permanently lock and brick building automation hardware. The vulnerability affects lighting, HVAC, window shutters, and other building control systems, causing complete operational failure. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added this vulnerability to its Known Exploited Vulnerabilities catalog, requiring federal agencies to apply mitigations by July 29, 2026. The long-term solution involves replacing legacy hardware with KNX Secure-capable devices that use AES-128 encryption.