Quick answers
- Is CVE-2026-12705 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-12705 being exploited in the wild.
- How severe is CVE-2026-12705?
- Medium severity, with a CVSS score of 6.4, published 17 July 2026.
- Which products and versions are affected?
- ABB KNX Update Tool (ABB) through 2.0.175; Busch-Jaeger KNX Update Tool (BJE) through 2.0.175.
- Is there a fix for CVE-2026-12705?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-12705 attacked?
- It is attacked from the adjacent network, in a network appliance.
- Am I affected by CVE-2026-12705?
- Check whether you run ABB KNX Update Tool (ABB) or Busch-Jaeger KNX Update Tool (BJE) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The ABB KNX Update Tool (ABB and BJE versions) through 2.0.175 is vulnerable to CWE-353 (Missing Support for Integrity Check). The software fails to implement mechanisms to verify that data has not been altered during transit or storage. An attacker with adjacent network access and low privileges could exploit this during update processes to inject malicious data or cause a denial-of-service condition. The attack complexity is considered high, likely requiring specific timing or man-in-the-middle positioning within the local network segment. ABB has released an advisory (9AKK108472A9270) regarding this issue.
Affected products
- ABB KNX Update Tool (ABB) through 2.0.175
- ABB KNX Update Tool (BJE) through 2.0.175
Timeline
- 2026-07-17: disclosed: Initial publication of CVE-2026-12705
- 2026-07-17: advisory: ABB released security advisory 9AKK108472A9270