Overly Restrictive Account Lockout in KNX Protocol (CVE‑2023‑4346) Enables Device Purge
What It Is – The KNX Association’s “Connection Authorization Option 1” implementation contains an account‑lockout mechanism that is so restrictive it can be abused to lock out legitimate users and, subsequently, purge all devices on a KNX network.
Exploitability – No public exploit code is known, but the vulnerability is exploitable by an attacker who can send crafted authentication attempts to a device. The NVD assigns a CVSS v3.1 base score of 7.8 (High).
Affected Products – KNX Protocol “Connection Authorization Option 1” as defined by the KNX Association. The flaw impacts any building‑automation device that implements this option (e.g., lighting, HVAC, security controllers).
Why It Matters for Trust & Control Assurance
- Access‑control hygiene – Over‑aggressive lockout policies break the balance between security and availability, undermining the control objective of “account lockout and authentication management.”
- Continuous evidence – Organizations must be able to demonstrate, via logs and configuration baselines, that lockout thresholds are aligned with operational risk, a key piece of audit‑ready evidence.
- Defensible audit trail – Regulators and enterprise buyers increasingly demand proof that authentication controls are both effective and proportionate; a mis‑configured lockout can be a red flag in a trust assessment.
Recommended Actions
- Apply the KNX Association’s latest firmware or configuration update that relaxes the lockout threshold.
- Review and document lockout settings against your organization’s authentication policy; ensure thresholds are calibrated to prevent denial‑of‑service while still deterring brute‑force attempts.
- Enable and centralise logging of authentication failures and lockout events; integrate these logs into a SIEM for continuous monitoring.
- Where possible, layer multi‑factor authentication or certificate‑based auth on top of KNX devices to reduce reliance on lockout alone.
Source: CISA KEV – CVE‑2023‑4346