ABB KNX Update Tool

Summary

ABB disclosed CVE-2026-12705 affecting KNX Update Tool versions ≤2.0.175, where missing integrity checks on firmware images allow attackers with physical bus access to tamper with or reverse-engineer firmware. The vulnerability affects only legacy KNX devices lacking the modern KNX Secure standard and cannot be fixed via software update due to fundamental protocol design limitations. ABB recommends avoiding legacy KNX devices for sensitive functions like access control and has no plans for corrective measures.

Full text

ICS Advisory ABB KNX Update Tool Release DateJuly 28, 2026 Alert CodeICSA-26-209-07 Related topics: Industrial Control System Vulnerabilities , Industrial Control Systems View CSAF Summary ABB has been contacted by a researcher who identified a vulnerability in one of its products. ABB has been contacted by a researcher who identified a vulnerability in one of its products. The vulnerability report has been shared in responsible disclosure. An attacker who successfully exploited this vulnerability could cause the product to become unusable. ABB confirms the vulnerability but at the same time acknowledges that the issue affects exclusively classic KNX devices that are not supporting the latest KNX Secure standard. Due to a lack of security in legacy KNX devices, the issue cannot be resolved via a software change. In order to actively exploit this vulnerability, an attacker requires physical access to the bus, the affected device is connected to. ABB has no plans of corrective measures. The following versions of ABB KNX Update Tool are affected: KNX Update Tool (ABB) <=2.0.175 (CVE-2026-12705) KNX Update Tool (BJE) <=2.0.175 (CVE-2026-12705) CVSS Vendor Equipment Vulnerabilities v3 6.4 ABB ABB KNX Update Tool Missing Support for Integrity Check Background Critical Infrastructure Sectors: Critical Manufacturing Countries/Areas Deployed: Worldwide Company Headquarters Location: Switzerland Vulnerabilities Expand All + CVE-2026-12705 There is no protection of the integrity of the firmware image. This applies exclusively to legacy KNX products View CVE Details Affected Products ABB KNX Update Tool Vendor:ABB Product Version:KNX Update Tool (ABB) <=2.0.175, KNX Update Tool (BJE) <=2.0.175 Product Status:known_affected Remediations MitigationDue to the nature of the classic KNX protocol stack and security concept, there are no options to resolve the vulnerability with a software update on a technical level. ABB recommends to follow general security recommendations listed in the security guideline (see References and General security recommendations). In addition, it shall be avoided to control sensitive functionality by legacy KNX devices such as, but not limited to, access control to e.g. hotel rooms or other protected areas. Note: Legacy KNX standards were never designed to meet state of the art security standards like introduced with KNX Data Secure published in 2017. Relevant CWE: CWE-353 Missing Support for Integrity Check Metrics CVSS Version Base Score Base Severity Vector String 3.1 6.4 MEDIUM CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H/E:F/RL:U/RC:C Acknowledgments Qiguang Zhang, Zhen Ling, Junzhou Luo, Chongqing Lei of Southeast University, Xinwen Fu of University of Massachusetts Lowell, and Yue Zhang of Shandong University reported this vulnerability through responsible disclosure. Notice The information in this document is subject to change without notice, and should not be construed as a commitment by ABB. ABB provides no warranty, express or implied, including warranties of merchantability and fitness for a particular purpose, for the information contained in this document, and assumes no responsibility for any errors that may appear in this document. In no event shall ABB or any of its suppliers be liable for direct, indirect, special, incidental or consequential damages of any nature or kind arising from the use of this document, or from the use of any hardware or software described in this document, even if ABB or its suppliers have been advised of the possibility of such damages. This document and parts hereof must not be reproduced or copied without written permission from ABB, and the contents hereof must not be imparted to a third party nor used for any unauthorized purpose. All rights to registrations and trademarks reside with their respective owners. Frequently Asked Questions What causes the vulnerability? - The vulnerability is a result of missing security features which were never specified for ABB legacy KNX products. What is BJE/ABB Firmware-Update 2.0? - The ETS app “ABB Firmware Update 2.0” and “BJE Firmware Update 2.0” is used to update the firmware of various ABB KNX devices directly via the KNX bus. The latest firmware files can be downloaded automatically from the Internet or imported manually. The app can be used with ETS 5 or later. What might an attacker use the vulnerability to do? - An attacker who successfully exploited this vulnerability could cause the affected product to stop working properly if physical access is given to the bus, the product is connected to. In cases the attacker is capable to reverse engineer the firmware of the product, (s)he could change the product behavior. It is a duty of the product and system owner to ensure that physical access to the field bus is limited to authorized personal. How could an attacker exploit the vulnerability? - An attacker could try to exploit the vulnerability by tampering the firmware image or intercept the data flow between the device and the firmware update tool. Could the vulnerability be exploited remotely? - No, to exploit this vulnerability an attacker would need to have physical access to an affected system node. It is assumed that the system is set up in accordance with commonly accepted security practices. Can functional safety be affected by an exploit of this vulnerability? - KNX devices are not in scope of functional safety standards. Why does ABB have no plans for corrective measures? - The security features, that are needed to fix this vulnerability with a perfect technical approach, cannot be delivered with a Software update. When this security advisory was issued, had this vulnerability been publicly disclosed? - No, ABB received information about this vulnerability through responsible disclosure. When this security advisory was issued, had ABB received any reports that this vulnerability was being exploited? - No, ABB had not received any information indicating that this vulnerability had been exploited when this security advisory was originally issued. Legal Notice and Terms of Use This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy). Recommended Practices CISA recommends users take defensive measures to minimize the exploitation risk of these vulnerabilities. Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet. Locate control system networks and remote devices behind firewalls and isolate them from business networks. When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures. CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies. CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies. Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents. Advisory Conversion Disclaimer This ICSA is a verbatim republication of ABB PSIRT 9AKK108472A9270 from a direct conversion of the vendor's Common Security Adviso

Indicators of Compromise

• cve — CVE-2026-12705

Entities