CISA Advises on Unpatchable Vulnerability in ABB KNX Update Tool
CISA has issued an advisory for a critical vulnerability in ABB's KNX Update Tool, noting that affected legacy devices will not receive a software fix.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has released an advisory detailing a significant vulnerability, identified as CVE-2026-12705, affecting ABB's KNX Update Tool. This flaw, stemming from a missing integrity check, impacts older KNX devices that do not support the more recent KNX Secure standard. Exploitation of this vulnerability requires an attacker to have physical access to the bus infrastructure to which the affected device is connected.
ABB has confirmed the existence of the vulnerability, emphasizing that it exclusively affects legacy KNX devices. Due to the inherent security limitations of these older systems, ABB has stated that a software-based fix is not feasible. The company's guidance suggests that the security features necessary for a complete resolution were not part of the original design for these classic KNX products, which predate modern security standards like KNX Data Secure introduced in 2017.
Successful exploitation could render the affected product unusable. While the vulnerability requires physical access, the potential for disruption to critical infrastructure sectors, such as critical manufacturing, is a concern. The CVSS v3.1 score for this vulnerability is 6.4 (MEDIUM), with specific metrics indicating potential for high impact on integrity and availability (I:H/A:H) if exploited, though requiring adjacent physical access (AV:A) and a complex attack path (AC:H).
ABB recommends that organizations follow general security guidelines and avoid controlling sensitive functions with legacy KNX devices. Examples of such sensitive functions include access control for hotel rooms or other secured areas, where a device failure could have significant consequences. The company also advises limiting physical access to the field bus to authorized personnel only.
The vulnerability was reported to ABB through a responsible disclosure process by researchers from Southeast University and the University of Massachusetts Lowell. ABB has stated that, as of the advisory's issuance, there were no reports of this vulnerability being actively exploited in the wild. However, the lack of a planned software fix means that organizations relying on these legacy devices must implement compensating controls.
Affected versions include KNX Update Tool (ABB) and KNX Update Tool (BJE) versions prior to 2.0.175. The advisory highlights that while the KNX Secure standard, introduced in 2017, addresses many of these security shortcomings, older devices remain vulnerable. This situation underscores the ongoing challenge of securing legacy operational technology (OT) environments where patching or upgrading may not be a straightforward option.
CISA has added this advisory to its ICS Advisories page, urging organizations to review the details and implement recommended mitigations. The advisory serves as a reminder of the persistent risks associated with unpatched or unpatchable systems in critical infrastructure and industrial control environments, where the long lifecycle of deployed hardware often outpaces security advancements.