CVE-2023-25556

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-04-18 · updated 2026-06-17
Weakness: CWE-287

Description

A CWE-287: Improper Authentication vulnerability exists that could allow a device to be compromised when a key of less than seven digits is entered and the attacker has access to the KNX installation.

Affected products

Schneider-Electric Merten Instabus Tastermodul 1Fach System M Firmware: 1.0
Schneider-Electric Merten Instabus Tastermodul 2Fach System M Firmware: 1.0
Schneider-Electric Merten Jalousie-/Schaltaktor Reg-K/8X/16X/10 M. Hb Firmware: 1.0
Schneider-Electric Merten Knx Argus 180/2,20M Up System Firmware: 1.0
Schneider-Electric Merten Knx Schaltakt.2X6A Up M.2 Eing. Firmware: 0.1
Schneider-Electric Merten Knx Uni-Dimmaktor Ll Reg-K/2X230/300 W Firmware: 1.0, 1.1
Schneider-Electric Merten Tasterschnittstelle 4Fach Plus Firmware: 1.0, 1.2

References

https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-045-03&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-045-03.pdf
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-045-03&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-045-03.pdf

Get alerted when CVE-2023-25556 or the next vulnerability affects your stack