| tiêu đề | Insta GmbH InstaKNXServiceApp_v1.2.3.1469.etsapp v1.2.3.1469 Insufficient Verification of Data Authenticity |
|---|
| Mô tả | KNX is a widely used building automation technology for controlling devices such as lighting, HVAC, sensors, actuators, and access-control-related components. ETS is the official engineering software used to configure and maintain KNX installations. Vendor-specific ETS Apps extend ETS with manufacturer-provided functionality, including device service operations and firmware update workflows. KNX Association clarified that ETS App validation focuses on the behavior of the ETS App with respect to the integrity and security of ETS and its data, but does not validate the security of the vendor ETS App itself. Therefore, the security of vendor-specific firmware update logic must be ensured by the corresponding manufacturer.
In a typical vendor-specific KNX firmware update workflow, the ETS App obtains or loads firmware update data, stores and parses the update package on the engineering workstation, maps the selected firmware to a target KNX device, and transfers the firmware payload to the physical device through the legitimate ETS/KNX communication path. For such a workflow to be secure, firmware authenticity and integrity must be preserved across the host-side stages and independently verified by the device before installation or activation.
A firmware update integrity verification weakness was identified in Insta KNX ServiceApp v1.2.3.1469. The analyzed update workflow appears to rely primarily on host-side validation and locally stored update data. However, the host-side integrity protections are insufficient against local tampering and may be bypassed by modifying local update data or associated metadata. More importantly, no independent device-side cryptographic verification of firmware authenticity or integrity was observed before the firmware is written to the KNX device. As a result, if the ETS workstation or its local update storage is compromised, tampered firmware data may still be transferred and accepted through the legitimate update workflow.
The potential impact is significant because KNX devices are used to control building automation functions. A local attacker with access to the ETS engineering workstation may be able to cause modified firmware to be installed on KNX devices, potentially resulting in persistent device compromise, device malfunction, denial of service, or disruption of lighting, HVAC, access control, alarm-related, and other building automation operations, depending on the affected device and deployment context. |
|---|
| Nguồn | ⚠️ https://gist.github.com/isZzzz/f9da7d76cf2f7b93ec3f90efe17ed323 |
|---|
| Người dùng | isZzzzz (UID 64489) |
|---|
| Đệ trình | 20/06/2026 06:52 (cách đây 2 các tháng) |
|---|
| Kiểm duyệt | 06/08/2026 10:29 (2 months later) |
|---|
| Trạng thái | được chấp nhận |
|---|
| Mục VulDB | 386531 [Insta InstaKNXServiceApp 1.2.3.1469 Firmware Update CreateWebClientAndDownloadFileList xác thực yếu] |
|---|
| điểm | 20 |
|---|