CVE-2024-4008 is a critical severity flaw in ABB and Busch-Jaeger building control devices, scored 9.6 by NVD. A leak of the factory default setup key (FDSK) lets an attacker with access to the local KNX bus take control. Read the ABB advisory for the fix and keep the KNX bus physically and logically protected.
What's affected
The record names the ABB and Busch-Jaeger FTS Display, version 1.00, and the BCU, version 1.3.0.33, and lists two ABB part numbers, 2TMA310010B0001 and 2TMA310011B0001, in the CPE data. The description says the FDSK leak allows an attacker to take control via access to the local KNX bus system.
The record states no fixed version and this write-up did not fetch the ABB advisory (document 9AKK108464A0803). Use that document for fixed firmware and for any workaround it gives.
The vector is adjacent network, low complexity, no privileges and no user interaction, with a changed scope. The KEV flag is false and the record reports no exploitation. This CVE and CVE-2024-4009 are published together for the same devices.
The NVD record is dated 2024-06-05 and carries the vector CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H, a score of 9.6 (Critical). Weakness class: CWE-497.
How to check if you're exposed
Find which panels in your buildings are the affected devices. Check the model, part number and firmware version on the device or in the building management software, and compare them with the versions in the record and the ABB advisory.
Then map where the KNX bus is accessible. The attack needs access to the local bus, so look for exposed bus connectors, unlocked cabinets, programming interfaces reachable from IT networks and IP gateways that bridge the bus to wider networks.
Do not probe a live building system without the facilities team's agreement.
What to do now
- Inventory the ABB and Busch-Jaeger FTS Display and BCU devices and their firmware.
- Read the ABB advisory and apply the firmware update or workaround it specifies.
- Restrict physical access to KNX cabling, cabinets and bus connectors.
- Segment any KNX IP gateways from general networks and require authentication on them.
- Review the KNX security settings and move to secure commissioning where the products support it.
Why it matters
The weakness is exposure of sensitive information to an unintended party, CWE-497. The FDSK is a setup key. If it can be learned from the bus, an attacker can use it to take part in commissioning the device, which is why the record speaks of taking control.
Building automation controls doors, climate and lighting, and its devices live for many years. The risk here is mostly local, which makes physical security and network separation the first line of defence while firmware is updated.
Quick check
Which devices are affected?
The record names the ABB and Busch-Jaeger FTS Display 1.00 and BCU 1.3.0.33.
Does an attacker need to be on the internet?
No. The description requires access to the local KNX bus, and the vector is adjacent network.
Sources
Last reviewed: 19 October 2026.
