Is KNX Secure? What the Attacks Taught Us and How to Protect a Smart Home in 2026

In short: KNX is a mature, open standard with built-in security (KNX Secure). The recorded attacks on KNX installations did not break the standard. They exploited a bad setup: port 3671 left open on the router for "easy" remote access. If your installation has no open ports, uses KNX Secure where supported and handles remote access with a VPN or an authorised gateway, you are in a very good position.

What happened in the attacks on KNX installations

In November 2021 Schneider Electric issued a security bulletin on confirmed cyber-attacks against KNX installations, with devices from various manufacturers. What they had in common:

• the installations had port 3671 forwarded on the router to the KNX/IP interface, effectively connecting the interface directly to the internet,
• the attackers changed set points and device passwords, making the devices useless and difficult, if not impossible, to recover.

The bulletin notes that this architecture is not supported, but was used by integrators for remote support. In other words: the installer's convenience became the owner's risk.

Step 1: Check whether your home is exposed

The KNX Association offers the free KNX Security Check at secure.knx.org. You open it from your home connection and it checks whether port 3671 responds from the internet. The check does not affect the system.

• If nothing responds: a good sign.
• If the KNX interface responds: the installation is reachable by anyone and the port forwarding must be closed immediately. Talk to your installer.

Step 2: KNX Secure

KNX has two layers of protection, enabled in ETS on compatible devices:

• KNX IP Secure: protects communication on the IP network, where interfaces, routers and app connections live.
• KNX Data Secure: encrypts and authenticates messages between the devices themselves, even on the bus cable or on wireless KNX RF.

In a new installation, ask for devices with KNX Secure and for it to be enabled where it makes sense, especially on IP interfaces and on devices in outdoor or shared areas.

Step 3: Remote access, done right

The owner wants control while away. The installer wants to make changes without a site visit. Both are possible without open ports:

• A VPN into the home network, with an up-to-date router.
• An authorised remote access gateway from a KNX manufacturer.
• ETS Cloud Connect: presented by the KNX Association as the alternative to opening port 3671, for secure access to installations over the internet, and now supported in ETS.

The logic is the same as for cameras and NVRs: never port forwarding, always an encrypted, authenticated channel.

Step 4: Segment the network

In June 2026 a vulnerability (CVE-2026-57473) was published in a Reolink camera hub: someone on the same local network could intercept the hub's traffic with its cameras and obtain the cameras' credentials. The company fixed it with a firmware update.

The lesson is not about one brand. It is that an infected laptop or a cheap Wi-Fi gadget can become the door to everything else. So:

• KNX/IP, cameras and IoT devices go on separate networks (VLANs), with rules on who talks to whom.
• Visitors use a guest network.
• The router, cameras and interfaces get firmware updates.

More in our home network guide.

What the new EU rules change

In September 2026 two EU obligations started to apply that affect every connected device in the home:

• Cyber Resilience Act, from 11/9/2026: Manufacturers must report actively exploited vulnerabilities and severe incidents through ENISA's platform: an early warning within 24 hours, a notification within 72 hours and a final report later. For what the CRA means when buying devices, see our earlier article.
• Data Act, from 12/9/2026: New connected products placed on the market must give users access to their data by default, easily, securely and in a machine-readable format.

For owners, this means vulnerabilities will become public faster, so who maintains and updates the system after handover matters more than ever. It also makes your devices' data more clearly yours, something a local system guaranteed from the start.

Owner's checklist

1. Run the KNX Security Check from your home.
2. Ask your installer how remote access works. If the answer is "I opened a port", ask for it to be changed.
3. Ask for KNX Secure on new devices and on IP interfaces.
4. Make sure KNX, cameras and IoT are on separate networks.
5. Ask for a copy of the ETS project and credentials, stored securely. Without them, recovery after a problem is hard.
6. Agree a maintenance plan with firmware updates.

How Sync-Teq works

In every installation we hand over, KNX is never exposed directly to the internet. Remote access runs through an encrypted channel, the network is segmented properly and the owner receives the ETS project. If you already have a KNX system and are unsure how it is set up, book a security check with our networking and cybersecurity team.

Sources

• Schneider Electric Security Bulletin SESB-2021-313-01: Cyber Attacks against KNX Systems Improperly Exposed to the Internet (9/11/2021)
• KNX Association: The KNX Security Check
• KNX Association: Light + Building 2026 show report (ETS Cloud Connect)
• INCIBE-CERT: CVE-2026-57473
• European Commission: CRA reporting obligations
• Loyens & Loeff: EU Data Act, new obligations for connected products