CISA Adds KNX Protocol Vulnerability to KEV Catalog – 7-15-26

Yesterday, CISA announced that it had added an overly restrictive account lockout mechanism vulnerability in the KNX Connection Authorization Protocol to the Known Exploited Vulnerability (KEV) catalog. The KNX Association previously disclosed the vulnerability in August of 2023. The KNX association provides generic set up suggestions to mitigate the vulnerability. 

The vulnerability was originally reported by Felix Eberstaller of Limes Security. The Limes Security Blog reported three campaigns {(2021 & 2023 here) and (2024 here)} exploiting the vulnerability. Limes reported having an unlock tool for affected devices. 

CISA has directed federal agencies using affected devices to apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk guidance and CISA’s “Forensics Triage Requirements”. Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. CISA has established a compliance deadline of July 26th, 2026. 

Review – Six Advisories Published – 8-24-23

Today, CISA’s NCCIC-ICS published six control system security advisories for products from Rockwell Automation, CODESYS (3), Opto 22, and KNX Association.

Advisories

Rockwell Advisory - This advisory discusses an out-of-bounds write vulnerability in select Input/Output Modules from Rockwell.

CODESYS Advisory #1 - This advisory describes an insufficient verification of data authenticity vulnerability in the CODESYS Development System.

CODESYS Advisory #2 - This advisory describes an insufficient verification of data authenticity vulnerability in the CODESYS Development System.

CODESYS Advisory #3 - This advisory describes an uncontrolled search path element vulnerability in the CODESYS Development System.

Opto 22 Advisory - This advisory describes 5 vulnerabilities in the Opto 22 SNAP PAC S1 product.

KNX Protocol Advisory - This advisory describes an overly restrictive account lockout mechanism vulnerability in the KNX Protocol.

 

For more details about these advisories, including links to researcher reports, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/six-advisories-published-8-24-23 - subscription required.