CVE-2024-4009 is a critical severity replay flaw in ABB and Busch-Jaeger building control devices, scored 9.2 by NVD. An attacker can capture and replay KNX telegrams on the local bus system. Read the ABB advisory for the fix and keep the KNX bus protected.
What's affected
The record names the ABB and Busch-Jaeger FTS Display, version 1.00, and the BCU, version 1.3.0.33. The description says the replay weakness lets an attacker capture and replay a KNX telegram to the local KNX bus system.
The record states no fixed version and this write-up did not fetch the ABB advisory (document 9AKK108464A0803). Use it for fixed firmware and any workaround.
The vector is local, low complexity, no privileges and no user interaction, with a changed scope. The record rates this 9.2, a little under the 9.6 given to CVE-2024-4008, which covers the key leak in the same devices. The KEV flag is false and the record reports no exploitation.
The NVD record is dated 2024-06-05 and carries the vector CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H, a score of 9.2 (Critical). Weakness class: CWE-294.
How to check if you're exposed
Identify the affected panels by model, part number and firmware, and compare them with the versions in the record and the ABB advisory.
Then look at who can reach the KNX bus. Replay needs the attacker to observe traffic and send telegrams, so any point on the bus or any gateway that passes telegrams matters. Check for exposed cabling, unsecured programming ports and IP gateways that connect the bus to general networks.
Coordinate with facilities staff before you test anything on a live system.
What to do now
- Inventory the affected ABB and Busch-Jaeger devices and their firmware.
- Read the ABB advisory and apply the update or workaround it gives.
- Secure physical access to bus cabling, cabinets and programming connectors.
- Keep KNX IP gateways off general networks and require authentication on them.
- Use KNX Secure features where your devices support them, so telegrams carry freshness checks.
Why it matters
The weakness is the use of authentication data that can be captured and reused, CWE-294. A message that was valid once is accepted again, because nothing in it proves it is new. Protocols defend against this with counters or timestamps that make an old message useless.
In building systems the effect can be physical, such as repeating a command that opens a door or changes a setting. As with the related key leak, local access to the bus is the starting point, so physical and network separation come first.
Quick check
What is a replay attack?
An attacker records a valid message and sends it again later. It works when the receiver cannot tell that the message is old.
Is there a fixed version?
The record does not state one. Check the ABB advisory.
Sources
Last reviewed: 19 October 2026.
