ABB legacy KNX devices lack firmware integrity check
A missing firmware integrity check in ABB's legacy KNX Update Tool lets an attacker with physical bus access tamper with device firmware, and ABB has no plans to fix it.
Sourcecisa.gov — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CISA republished an ABB PSIRT advisory describing CVE-2026-12705, a missing firmware image integrity check (CWE-353) affecting the ABB and Busch-Jaeger (BJE) KNX Update Tool versions 2.0.175 and earlier. The flaw impacts only classic/legacy KNX devices that do not support the newer KNX Data Secure standard introduced in 2017; because these legacy devices lack the underlying security architecture needed, ABB states the issue cannot be resolved with a software update and has no corrective measures planned.
Exploitation requires physical access to the KNX bus the target device is connected to — there is no remote attack vector. An attacker with such access could tamper with or intercept the firmware image during an update, potentially causing the device to malfunction or, if capable of reverse engineering the firmware, altering device behavior. ABB recommends general security guidelines and specifically advises against using legacy KNX devices for sensitive functions such as access control (e.g., hotel room locks). The vulnerability was responsibly disclosed by academic researchers from Southeast University, University of Massachusetts Lowell, and Shandong University, and there is no evidence of in-the-wild exploitation. Given the requirement for physical bus access and absence of active exploitation, this is a low-urgency but persistent architectural weakness in widely deployed building automation hardware.
Mentioned in this report
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-209-07
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs