KNX Devices BCU Key Lockout Vulnerability (CVE-2023-4346) Analysis and Mitigation Guide

1. Network Isolation & Access Control

• Disable Public Exposure: Ensure that KNX IP routers and interfaces are not exposed to the public internet.
• Implement VPN: Use secure VPN tunnels (e.g., IPsec, WireGuard) for any remote maintenance or access to the KNX network.

2. Enable KNX Secure

• Deploy KNX IP Secure / Data Secure: Enable cryptographic authentication and encryption on the KNX bus to prevent unauthorized configuration changes and BCU key manipulation.

3. Physical Security Controls

• Secure physical access to KNX bus lines, cabinets, and devices to prevent attackers from connecting directly to the medium and exploiting the vulnerability.

4. Firewall Rule Example (Port Blocking)

Block external access to the default KNX port (UDP 3671):

# Block external KNX traffic using iptables
iptables -A INPUT -p udp --dport 3671 -j DROP
# Allow only trusted administrator IP
iptables -I INPUT -s 192.168.1.100 -p udp --dport 3671 -j ACCEPT

This vulnerability (CVE-2023-4346) exists in KNX devices that implement KNX Connection Authorization and support Option 1.

The BCU (Bus Coupling Unit) key feature is designed to password-protect KNX devices. However, depending on the vendor's implementation, this password often cannot be reset without providing the currently configured password.

If an attacker gains access to the KNX installation network, they can purge all devices that lack additional security options and set an arbitrary BCU key, effectively locking the legitimate users out of the device. This results in a permanent Denial of Service (DoS) where the hardware may require physical replacement. This exploit can be executed either remotely via an exposed network interface or locally through direct physical access to the device.

As this vulnerability is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, active exploitation has been observed, making immediate remediation critical.