Critical Analysis: CVE-2023-4346 - KNX Association KNX Protocol Connection Authorization Option... — July 19, 2026

Published 19 Jul 2026 · vulnerability management, CVE analysis, threat intelligence, security operations, cybersecurity news

AGMP Partners Initial Discovery and Context Alright, let's talk about CVE-2023-4346, a vulnerability that, while seemingly straightforward on the surface – an overly restrictive account lockout mechanism – reveals deeper architectural concerns within the KNX protocol at large. This isn't some memory corruption flaw or an RCE vector, but its implications for critical infrastructure and building automation systems (BAS) are significant. The CVE was published on July 19, 2026, but the underlying issue has likely existed in the wild much longer. Our analysts at AGMP Partners have been tracking issues within legacy industrial control system (ICS) protocols for years, and this one caught our attention precisely because it impacts the fundamental availability and management of KNX devices, which are pervasive in building automation, from smart homes to large-scale commercial and industrial faci