CVE-2024-4008: ABB 2TMA310010B0001 Auth Bypass Vulnerability

CVE-2024-4008 Overview

CVE-2024-4008 is an information disclosure vulnerability affecting ABB and Busch-Jaeger FTS Display (version 1.00) and Bus Coupling Unit (BCU) version 1.3.0.33. The devices leak the Factory Default Setup Key (FDSK), which is used to secure KNX Secure communications on the building automation bus. An attacker with access to the local KNX bus system can retrieve the FDSK and take control of affected devices. The flaw is tracked as an exposure of sensitive information to an unauthorized actor [CWE-497].

Critical Impact
An attacker on the adjacent KNX bus can obtain the FDSK and gain control over ABB and Busch-Jaeger building automation devices, compromising integrity and availability of connected KNX systems.

Affected Products

ABB / Busch-Jaeger FTS Display firmware version 1.00 (2TMA310010B0001, 2TMA310011B0001)
ABB / Busch-Jaeger BCU firmware version 1.3.0.33 (2TMA310011B0002, 2TMA310010B0003)
ABB / Busch-Jaeger KNX device 2TMA310011B0003 and associated firmware

Discovery Timeline

2024-06-05 - CVE-2024-4008 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-4008

Vulnerability Analysis

The vulnerability affects the KNX Secure provisioning model used by ABB Busch-Jaeger FTS Display and BCU devices. KNX Secure relies on the Factory Default Setup Key (FDSK), a per-device secret used during commissioning to derive tool keys that authenticate and encrypt bus traffic. The affected firmware exposes the FDSK on the local KNX bus, defeating the confidentiality assumption of the KNX Data Secure protocol. An attacker who can send and receive frames on the KNX bus can harvest the FDSK, then generate a valid tool key, decrypt secure telegrams, and issue authenticated commands. This grants control of connected loads, sensors, and access-related devices in the building automation environment.

Root Cause

The root cause is exposure of sensitive information to an unauthorized actor [CWE-497]. The FTS Display and BCU firmware do not enforce that the FDSK remain confidential to authorized commissioning tools. Instead, the key material becomes retrievable through the local KNX bus, violating the KNX Secure trust model.

Attack Vector

Exploitation requires adjacent network access to the KNX bus system. This typically means physical or logical presence on the wired KNX TP1 bus, on a KNXnet/IP router segment, or on a KNX RF segment within range of the target installation. No user interaction and no prior authentication are required. Once the attacker obtains the FDSK, they can impersonate the device to the commissioning tool or take administrative control of the device, altering configuration and manipulating attached actuators.

Verified proof-of-concept code is not publicly available. See the ABB Technical Document for vendor technical details.

Detection Methods for CVE-2024-4008

Indicators of Compromise

Unexpected KNX Secure commissioning traffic addressed to FTS Display or BCU devices from unknown physical or individual addresses
New or modified group address assignments and tool key updates on devices that were not scheduled for recommissioning
Unplanned appearance of USB, IP, or RF interfaces bridged to the KNX bus

Detection Strategies

Baseline KNX bus telegrams and alert on secure property read requests targeting FDSK-related interface objects on affected devices
Monitor KNXnet/IP routers and gateways for tunneling sessions initiated by unauthorized hosts on the operational technology network
Correlate physical access logs for building automation cabinets with periods of unexpected KNX bus activity

Monitoring Recommendations

Deploy a KNX bus monitor or logging gateway to record all telegrams on segments containing affected FTS Display and BCU devices
Forward KNXnet/IP router logs and network flow data to a centralized SIEM or data lake for retention and analysis
Review commissioning tool audit trails to confirm that every tool key change corresponds to an authorized project activity

How to Mitigate CVE-2024-4008

Immediate Actions Required

Restrict physical and network access to KNX bus segments that include the affected FTS Display and BCU devices
Segment KNXnet/IP traffic from general IT networks using firewalls and VLANs, and block KNXnet/IP multicast at network boundaries
Assume the FDSK is compromised on any exposed device and re-commission with a new tool key after applying vendor guidance

Patch Information

Refer to the ABB Technical Document for vendor remediation guidance covering FTS Display firmware 1.00 and BCU firmware 1.3.0.33. Apply the fixed firmware version specified in the advisory to all affected 2TMA310010B0001, 2TMA310011B0001, 2TMA310011B0002, 2TMA310010B0003, and 2TMA310011B0003 units.

Workarounds

Physically secure KNX bus wiring, junction boxes, and control cabinets to prevent adjacent-bus access by unauthorized personnel
Disable or remove unused KNXnet/IP tunneling and routing interfaces that expose the bus to broader networks
Where feasible, replace affected devices with models that do not expose FDSK material on the bus until patched firmware is deployed

bash

# Example: block KNXnet/IP (UDP 3671) at the OT network boundary
iptables -A FORWARD -p udp --dport 3671 -j DROP
iptables -A FORWARD -p udp --sport 3671 -j DROP