CVE-2026-12705: ABB KNX Update Tool Cannot Be Patched
Because legacy KNX devices predate the protocol's 2017 security standard, the only path is physical access control and limiting their use in sensitive functions.
TL;DR
ABB has confirmed CVE-2026-12705, a missing-integrity-check vulnerability (CWE-353) in the KNX Update Tool that cannot be resolved with a software update. The issue affects classic KNX devices that don't support the KNX Secure standard published in 2017. Exploitation requires physical access to the KNX bus and could allow an attacker to tamper with firmware images, altering device behavior. ABB recommends restricting physical access to the bus and avoiding legacy KNX devices for sensitive functions such as access control. The CVSS 3.1 score is 6.4 (MEDIUM).
The vulnerability sits at the intersection of firmware update tooling and a protocol that was never designed with integrity in mind. ABB's KNX Update Tool, used to push firmware to KNX devices over the bus from within ETS 5 or later, has no mechanism to verify that a firmware image hasn't been tampered with during transit or at rest. An attacker with physical access to the KNX bus could substitute a malicious firmware image, altering device behavior without detection.
ABB is explicit that this isn't something it can fix in software. The affected devices are classic KNX products that don't support the KNX Secure standard, which introduced security features to the protocol in 2017. The missing integrity check, classified as CWE-353, is rooted in the original protocol specification rather than in an implementation error. ABB's advisory states that "the security features that are needed to fix this vulnerability with a perfect technical approach cannot be delivered with a software update."
The practical impact turns on physical access. The attack vector requires adjacency to the KNX bus, not a network connection, which narrows the threat surface. Someone who can touch the bus can exploit the flaw.
But for building automation systems where KNX bus wiring runs through shared spaces or physically accessible junction boxes, the barrier isn't high. The CVSS 3.1 score of 6.4 reflects the constraints: adjacent attack vector and high complexity, countered by high integrity and availability impact.
ABB's mitigation guidance is twofold: follow the general security recommendations in its security guideline, and avoid putting legacy KNX devices in control of sensitive functions. The advisory specifically calls out access control to hotel rooms and other protected areas as examples where legacy devices shouldn't be used.
The vulnerability was reported through responsible disclosure by a team from Southeast University, University of Massachusetts Lowell, and Shandong University. ABB says it has no reports of exploitation. CISA republished the advisory verbatim from ABB's CSAF feed.
Published ·Deep Fathom