ABB KNX Update Tool: 1 CVE, Medium 6.4
Summary
CISA reports 1 vulnerability in ABB KNX Update Tool (ABB), KNX Update Tool (BJE). Weakness type: Missing Support for Integrity Check. ABB has been contacted by a researcher who identified a vulnerability in one of its products. ABB has been contacted by a researcher who identified a vulnerability in one of its products. The vulnerability report has been shared in responsible disclosure. Highest CVSS v3 score: 6.4 (Medium), exploitable from an adjacent network.
At a glance
- Vendor
- ABB
- Products
- KNX Update Tool (ABB), KNX Update Tool (BJE)
- CVEs
- CVE-2026-12705
- Highest CVSS v3
- 6.4 CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H/E:F/RL:U/RC:C
- Highest CVSS v4
- –
- Known exploited (KEV)
- No CVE from this advisory is on the KEV list as of the last refresh
- Sectors (per CISA)
- Critical Manufacturing
- Deployed
- Worldwide
- Vendor HQ
- Switzerland
Vulnerabilities
| CVE | Weakness | CVSS v3 | CVSS v4 | KEV | Description (from advisory) |
|---|---|---|---|---|---|
| CVE-2026-12705 | Missing Support for Integrity Check | 6.4 | – | No | CVE-2026-12705 |
Affected products (2)
- KNX Update Tool (ABB) <=2.0.175
- KNX Update Tool (BJE) <=2.0.175
Vendor fixes and mitigations (from advisory)
- Mitigation: Due to the nature of the classic KNX protocol stack and security concept, there are no options to resolve the vulnerability with a software update on a technical level. ABB recommends to follow general security recommendations listed in the security guideline (see References and General security recommendations). In addition, it shall be avoided to control sensitive functionality by legacy KNX devices such as, but not limited to, access control to e.g. hotel rooms or other protected areas. Note: Legacy KNX standards were never designed to meet state of the art security standards like introdu
Also apply CISA's standard ICS practices: minimize network exposure, keep control networks behind firewalls and isolated from business networks, and use up-to-date secure remote access.
Sources
- CISA advisory ICSA-26-209-07
- Machine-readable CSAF record
- https://psirt.abb.com/csaf/2026/9akk108472a9270.json
- https://search.abb.com/library/Download.aspx?DocumentID=9AKK108472A9270&LanguageCode=en&Do
- https://new.abb.com/low-voltage/products/building-automation/product-range/abb-i-bus-knx/c
This page is generated automatically from the CISA advisory text. It is not a substitute for the vendor's guidance; verify affected versions and fixes at the source before making changes to control systems.