ABB became aware of severe vulnerability in the products versions listed as affected in the advisory.

The Windows gateway is accessible remotely by default. Unauthenticated attackers can therefore search for PLCs, but the user management of the PLCs prevents the actual access to the PLCs – unless it is disabled

Summary

Support

Notice

General security recommendations

Purpose

What causes the vulnerability?
- Refer to section “Vulnerability severity and details“.

What is the ABB Automation Builder?
- The ABB Automation Builder is the programming and commissioning tool mainly for the ABB PLC AC500 and the operator panels CP600.

What might an attacker use the vulnerability to do?
- An attacker who successfully exploited this vulnerability could scan for connected PLCs.

Could the vulnerability be exploited remotely?
- Yes, an attacker who has network access to an affected system node could exploit this vulnerability. Recommended practices include that process control systems are physically protected, have no direct connections to the Internet, and are separated from other networks by means of a firewall system that has a minimal number of ports exposed.

What does the update do?
- The update removes the vulnerability by setting the defaults of the gateway to local access.

When this security advisory was issued, had this vulnerability been publicly disclosed?
- Yes, this vulnerability has been publicly disclosed.

When this security advisory was issued, had ABB received any reports that this vulnerability was being exploited?
- No, ABB had not received any information indicating that this vulnerability had been exploited when this security advisory was originally issued.

Frequently Asked Questions

Summary: 2025-02: CODESYS (Edge) Gateway for Windows insecure default

ABB Automation Builder Gateway for Windows with insecure defaults

Summary: Initial version.

Initialization of a Resource with an Insecure Default

The gateway serves as a communication channel for various clients to AC500 PLCs. By default, the gateway listens on all available network adapters on port 1217 and can therefore be accessed remotely. How-ever, remote access to the gateway is only required in certain network configurations. Since the gateway is usually accessed locally, many users are unaware of this remote access option, which can enable scan-ning of and access to restricted PLC networks. Unauthenticated attackers can therefore search for PLCs, but the user management of the PLCs prevents the actual access to the PLCs – unless it is disabled.

Please note that the gateway for Windows can be installed as a separate setup or as part of other setups such as the CODESYS Development System V3 setup or the CODESYS OPC DA Server setup.

CVE description

Summary: NVD - CVE-2024-41975

If remote access is not required, check the "LocalAddress" setting in the [CmpGwCommDrvTcp] section of the Gateway's configuration file as follows (restart of gateway required in case of changes):

[CmpGwCommDrvTcp] LocalAddress=127.0.0.1 ; allow access only from the local computer

The gateway configuration file can be located at (example for Automation Builder 2.8): %ProgramFiles%\ABB\AB2.8\AutomationBuilder\GatewayPLC\Gateway.cfg

Starting with Automation Builder version 2.9.0 the vulnerability is closed by setting the default for the gateway to local access. Automation Builder 2.9.0 is available for download from the related download site.

https://www.abb.com/global/en/areas/motion/digital-tools/automation-builder/software-download

Workarounds are specific measures that a user can take to help block an attack, for example, temporarily disabling the vulnerable feature may remove the exposure with well-known impact on functionality. ABB has tested the following workarounds. Although these workarounds will not correct the underlying vulnerability, they can help block known attack vectors. When a workaround reduces functionality, this is identified below as “Impact of workaround”.

The vulnerability can be closed by enabling local access only. See chapter “Recommended immediate actions” for details.

CVE-2024-41975


ABB became aware of vulnerability in the products versions listed as affected in the advisory. An update is available that resolves publicly reported vulnerability.

An attacker who successfully exploited these vulnerabilities could cause a crash, denial-of-service (DoS), or potentially remote code execution.

Summary

For additional instructions and support please contact your local ABB service organization. For contact information, see www.abb.com/contactcenters.

Information about ABB’s cyber security program and capabilities can be found at www.abb.com/cybersecurity.

Support

The information in this document is subject to change without notice, and should not be construed as a commitment by ABB.

ABB provides no warranty, express or implied, including warranties of merchantability and fitness for a particular purpose, for the information contained in this document, and assumes no responsibility for any errors that may appear in this document. In no event shall ABB or any of its suppliers be liable for direct, indirect, special, incidental or consequential damages of any nature or kind arising from the use of this document, or from the use of any hardware or software described in this document, even if ABB or its suppliers have been advised of the possibility of such damages.

This document and parts hereof must not be reproduced or copied without written permission from ABB, and the contents hereof must not be imparted to a third party nor used for any unauthorized purpose.

All rights to registrations and trademarks reside with their respective owners.

Notice

For any installation of software-related ABB products we strongly recommend the following (non-exhaustive) list of cyber security practices:
- Isolate special purpose networks (e.g. for automation systems) and remote devices behind firewalls and separate them from any general-purpose network (e.g. office or home networks).
- Install physical controls so no unauthorized personnel can access your devices, components, peripheral equipment, and networks.
- Never connect programming software or computers containing programing software to any network other than the network for the devices that it is intended for.
- Scan all data imported into your environment before use to detect potential malware infections.
- Minimize network exposure for all applications and endpoints to ensure that they are not accessible from the Internet unless they are designed for such exposure and the intended use requires such.
- Ensure all nodes are always up to date in terms of installed software, operating system, and firmware patches as well as anti-virus and firewall.
- When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.

General security recommendations

ABB has a rigorous internal cyber security continuous improvement process which involves regular testing with industry leading tools and periodic assessments to identify potential product issues. Occasionally an issue is determined to be a design or coding flaw with implications that may impact product cyber security.

When a potential product vulnerability is identified or reported, ABB immediately initiates our vulnerability handling process. This entails validating if the issue is in fact a product issue, identifying root causes, determining what related products may be impacted, developing a remediation, and notifying end users and governmental organizations.

The resulting Cyber Security Advisory intends to notify customers of the vulnerability and provide details on which products are impacted, how to mitigate the vulnerability or explain workarounds that minimize the potential risk as much as possible. The release of a Cyber Security Advisory should not be misconstrued as an affirmation or indication of an active threat or ongoing campaign targeting the products mentioned here. If ABB is aware of any specific threats, it will be clearly mentioned in the communication.

The publication of this Cyber Security Advisory is an example of ABB’s commitment to the user community in support of this critical topic. Responsible disclosure is an important element in the chain of trust we work to maintain with our many customers. The release of an Advisory provides timely information which is essential to help ensure our customers are fully informed.

Purpose

What causes the vulnerability?
- Parsing CMS AuthEnvelopedData or EnvelopedData message with maliciously crafted AEAD parameters can trigger a stack buffer overflow.

What is AC500 V3?
- The AC500 V3 is a scalable range of Programmable Logic Controller (PLC). It provides solutions for small, medium and high-end applications. The AC500 V3 platform offers different performance levels and is the ideal choice for high availability, extreme environments, condition monitoring, motion control or safety solutions. It offers interoperability and compatibility in hardware and software from compact PLCs up to high end and safety PLCs.

What might an attacker use the vulnerability to do?
- An attacker who successfully exploited these vulnerabilities could cause a crash, denial-of-service (DoS), or potentially remote code execution.

How could an attacker exploit the vulnerability?
- Refer to section “Vulnerability severity and details“.

Could the vulnerability be exploited remotely?
- Yes, an attacker who has network access to an affected system node could exploit the vulnerabilities. Recommended practices include that process control systems are physically protected, have no direct connections to the Internet, and are separated from other networks by means of a firewall system that has a minimal number of ports exposed.

When this security advisory was issued, had this vulnerability been publicly disclosed?
- Yes, the vulnerabilities have been publicly disclosed.

When this security advisory was issued, had ABB received any reports that this vulnerability was being exploited?
- No, ABB had not received any information indicating that this vulnerability had been exploited when this security advisory was originally issued.

Frequently Asked Questions

Summary: ABB CYBERSECURITY ADVISORY - PDF Version

Summary: ABB CYBERSECURITY ADVISORY - CSAF Version

Summary: OpenSSL Security Advisory [27th January 2026]

AC500 V3 Stack buffer overflow in Cryptographic Message Syntax

Summary: Initial version.

ABB AC500 V3 Firmware 3.9.0 installed on ABB AC500 V3 PM5xxx

ABB AC500 V3 Firmware 3.9.0 HF1 installed on ABB AC500 V3 PM5xxx

When parsing CMS (Auth)EnvelopedData structures that use AEAD ciphers such as AES-GCM, the IV (Initialization Vector) encoded in the ASN.1 parameters is copied into a fixed-size stack buffer without verifying that its length fits the destination. An attacker can supply a crafted CMS message with an oversized IV, causing a stack-based out-of-bounds write before any authentication or tag verification occurs.

Because the overflow occurs prior to authentication, no valid key material is required to trigger it. While exploitability to remote code execution depends on platform and toolchain mitigations, the stack-based write primitive represents a severe risk.

CVE description

Summary: NVD - CVE-2025-15467

The problem is corrected in the following product version:
- AC500 V3 firmware version 3.9.0 HF1

ABB recommends that customers apply the update at earliest convenience. This firmware version is released for all AC500 V3 PLC types and available for download from the ABB library.

https://search.abb.com/library/Download.aspx?DocumentID=3ADR011537&LanguageCode=en&DocumentPartId=&Action=Launch

Refer to section “General security recommendations” for further advise on how to keep your system secure.

CVE-2025-15467


© Copyright 2025 ABB. All rights reserved.

An update is available that resolves vulnerability in the product versions listed as affected in this advisory.

A path traversal vulnerability in these products can allow unauthenticated users to gain access to restricted directories. Exploiting this vulnerability can lead to complete system compromise and exposure of sensitive information.

Summary

For any installation of software-related ABB products we strongly recommend the following (non-exhaustive) list of cyber security practices:

– Isolate special purpose networks (e.g. for automation systems) and remote devices behind firewalls and separate them from any general-purpose network (e.g. office or home networks).

– Install physical controls so no unauthorized personnel can access your devices, components, peripheral equipment, and networks.

– Never connect programming software or computers containing programing software to any network other than the network for the devices that it is intended for.

– Scan all data imported into your environment before use to detect potential malware infections.

– Minimize network exposure for all applications and endpoints to ensure that they are not accessible from the Internet unless they are designed for such exposure and the intended use requires such.

– Ensure all nodes are always up to date in terms of installed software, operating system, and firmware patches as well as anti-virus and firewall.

– When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.

General security recommendations

Support

The information in this document is subject to change without notice and should not be construed as a commitment by ABB.

ABB provides no warranty, express or implied, including warranties of merchantability and fitness for a particular purpose, for the information contained in this document, and assumes no responsibility for any errors that may appear in this document. In no event shall ABB or any of its suppliers be liable for direct, indirect, special, incidental or consequential damage of any nature or kind arising from the use of this document, or from the use of any hardware or software described in this document, even if ABB or its suppliers have been advised of the possibility of such damage.

This document and parts hereof must not be reproduced or copied without written permission from ABB, and the contents hereof must not be imparted to a third party nor used for any unauthorized purpose.

All rights to registrations and trademarks reside with their respective owners.

Notice

The path traversal vulnerability is only exploitable when the attacker has local access to the machine hosting the web application (i.e., access to localhost). To mitigate this vulnerability, the affected products should be configured to restrict local access to authorized users only, ensuring that untrusted users cannot interact with the application directly on the host system.

ABB has restricted file downloads to a specific directory designated solely for downloadable content. Strict input validation and path sanitization are implemented to ensure that only legitimate file paths within this directory can be accessed.

Refer to section “General Security Recommendations” for further advise on how to keep your system secure.

Mitigating factors

Purpose

What causes the vulnerability?

The vulnerability is caused by unchecked input data in the file parameter in the CoreSense products.

What might an attacker use the vulnerability to do?

An attacker who successfully exploited this vulnerability can allow unauthenticated users to gain access to restricted directories and can lead to complete system compromise and exposure of sensitive information.

How could an attacker exploit the vulnerability?

Path traversal would require that the attacker has access to the system local network, by connecting to the system directly or through a wrongly configured or penetrated firewall, or that he installs malicious software on a system node or otherwise infects the network with malicious software.

Recommended practices help mitigate such attacks, see section Mitigating Factors above.

Could the vulnerability be exploited remotely?

No.

Can functional safety be affected by an exploit of this vulnerability?

No.

What does the update do?

The update removes the vulnerability by modifying the way that the file parameter validates and verifies input data.

When this security advisory was issued, had this vulnerability been publicly disclosed?

No, ABB received information about this vulnerability through responsible disclosure.

When this security advisory was issued, had ABB received any reports that this vulnerability was being exploited?

No, ABB had not received any information indicating that this vulnerability had been exploited when this security advisory was originally issued.

Frequently Asked Questions

Summary: ABB CYBERSECURITY ADVISORY - PDF version

Summary: ABB CYBERSECURITY ADVISORY - CSAF version

CoreSense™ HM and CoreSense™ M10  File Path Traversal Vulnerability

Summary: Initial version.

Summary: Addressed comments.

Summary: Fixed incorrect links.

Summary: Final version with corrected dates.

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE description

Summary: NVD - CVE-2025-3465

The vulnerabilities are corrected in the following version:

CoreSense™ HM v2.3.4 & CoreSense™ M10 v1.4.1.31

ABB recommends that customers apply the update at the earliest convenience.

CVE-2025-3465


ABB is aware of public reports of vulnerabilities in a 3rd party component VLC media player Version 2.2.4 which was delivered together with the installation package of Camera Connect Version 1.5.0.14 and below. An update is available that resolves a privately reported outdated 3rd party component with vulnerabilities in the product versions listed as affected in this advisory.

An attacker who successfully exploited any of these vulnerabilities in the 3rd party component could potentially compromise the system in different ways.

Summary

For any installation of software-related ABB products we strongly recommend the following (non-exhaustive) list of cyber security practices:

–	Isolate special purpose networks (e.g. for automation systems) and remote devices behind fire-walls and separate them from any general-purpose network (e.g. office or home networks).

–	Install physical controls so no unauthorized personnel can access your devices, components, peripheral equipment, and networks.

–	Never connect programming software or computers containing programing software to any net-work other than the network for the devices that it is intended for.

–	Scan all data imported into your environment before use to detect potential malware infections.

–	Minimize network exposure for all applications and endpoints to ensure that they are not accessible from the Internet unless they are designed for such exposure and the intended use requires such.

–	Ensure all nodes are always up to date in terms of installed software, operating system, and firm-ware patches as well as anti-virus and firewall.

–	When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.

General security recommendations

Support

Notice

ABB has a rigorous internal cyber security continuous improvement process which involves regular testing with industry leading tools and periodic assessments to identify potential product issues. Occasionally an issue is determined to be a design or coding flaw with implications that may impact product cyber security.

When a potential product vulnerability is identified or reported, ABB immediately initiates our vulner-ability handling process. This entails validating if the issue is in fact a product issue, identifying root causes, determining what related products may be impacted, developing a remediation, and notifying end users and governmental organizations.

The resulting Cyber Security Advisory intends to notify customers of the vulnerability and provide details on which products are impacted, how to mitigate the vulnerability or explain workarounds that minimize the potential risk as much as possible. The release of a Cyber Security Advisory should not be misconstrued as an affirmation or indication of an active threat or ongoing campaign targeting the products mentioned here. If ABB is aware of any specific threats, it will be clearly mentioned in the communication.

The publication of this Cyber Security Advisory is an example of ABB’s commitment to the user com-munity in support of this critical topic. Responsible disclosure is an important element in the chain of trust we work to maintain with our many customers. The release of an Advisory provides timely in-formation which is essential to help ensure our customers are fully informed.

Purpose

What causes the vulnerability?

The vulnerability is caused by unchecked input data in the VLC media player in Camera Connect

What is <affected product or component>?

VLC media player

What might an attacker use the vulnerability to do?

An attacker who successfully exploited this vulnerability could cause the affected system node to stop or become inaccessible and allow the attacker to insert and run arbitrary code .

How could an attacker exploit the vulnerability?

An attacker could try to exploit the vulnerability by creating a specially crafted file, copying the file to affected system nodes and then manually open the file via VLC Mediaplayer. This would require that the attacker has access to the system network, by connecting to the network either directly or through a wrongly configured or penetrated firewall, or that he installs malicious software on a system node or otherwise infects the network with malicious software. Recommended practices help mitigate such attacks, see section Mitigating Factors above.

Could the vulnerability be exploited remotely?

No, to exploit this vulnerability an attacker would need to have physical access to an affected system node.

Can functional safety be affected by an exploit of this vulnerability?

While these vulnerabilities primarily impact confidentiality, integrity, and availability, they do not directly affect functional safety in the traditional sense. However, a compromised system (due to arbitrary code execution or a critical service crash) may compromise safety-related processes dependent on VLC, potentially disrupting business operations or compliance.

What does the update do?

The update removes the vulnerability by providing a newer version of the VLC media player

When this security advisory was issued, had this vulnerability been publicly disclosed?

This vulnerability has been publicly disclosed for the 3rd party component, but not for the ABB product using this component

When this security advisory was issued, had ABB received any reports that this vulnerability was being exploited?

No, ABB had not received any information indicating that this vulnerability had been exploited when this security advisory was originally issued.

Frequently Asked Questions

ABB Ability Camera Connect Vulnerabilities in outdated 3rd party component (VLC)

Summary: Initial version.

Summary: Correction in References

VLC media player 3.0.20 and earlier is vulnerable to denial of service through an integer overflow which could be triggered with a maliciously crafted mms stream (heap based overflow). If successful, a malicious third party could trigger either a crash of VLC or an arbitrary code execution with the target user's privileges.

CVE description

Summary: NVD - CVE-2024-46461

The VLC-based component operates solely within completely isolated environments without internet access or any connectivity to external networks. Consequently:

•	No exposure to untrusted MMS streams: The integer overflow vulnerability relies on handling a maliciously crafted external stream, which is not possible in isolated environments

•	No remote attacker access: Without network ingress, attackers cannot trigger the vulnerability remotely.

•	Drastically reduced attack surface: The absence of any external media inputs effectively neutralizes the exploit path, significantly lowering the risk of both denial of service and code execution.

The problem is corrected in the following product versions:

ABB Ability Camera Connect 1.5.0.15

The 3rd party component has already been updated. The easiest path to mitigate the problem is an update of just VLC Media Player by the customer. ABB recommends that customers apply the update at earliest convenience.

It is also possible to update to the latest Version of Camera Connect.

CVE-2024-46461

Videolan VLC prior to version 3.0.20 contains an Integer underflow that leads to an incorrect packet length.

CVE description

Summary: NVD - CVE-2023-47360

•	Air-gapped environments only: Camera Connect is deployed in completely isolated environments lacking any network connectivity or internet access.

•	No exposure to MMS streams: The vulnerability depends on processing crafted MMS streams, which cannot originate from external or internal network sources when the system is air-gapped.

•	Elimination of remote attack surface: Without any method for an attacker to deliver malicious media inputs, the vulnerability cannot be triggered remotely.

•	Strong reduction in exploitation risk: The combined absence of external media ingestion and unavailable network paths effectively neutralizes the integer underflow exploit, significantly reducing the likelihood of both denial-of-service and memory corruption scenarios.

CVE-2023-47360

Videolan VLC prior to version 3.0.20 contains an incorrect offset read that leads to a Heap-Based Buffer Overflow in function GetPacket() and results in a memory corruption.

CVE description

Summary: NVD - CVE-2023-47359

Given that Camera Connect is deployed exclusively in fully isolated, air-gapped environments with no internet access or external network connectivity, the following risk-reduction factors apply:

•	No exposure to crafted MMS streams: The exploit requires the receipt of specially crafted packets via the MMS protocol, which cannot occur without network connectivity.

•	Network attack vector eliminated: As the vulnerability’s CVSS vector highlights a network-based attack (AV:N), the lack of any ingress network path nullifies the attack surface.

•	Low likelihood of exploitation: Without access to malicious media input, there is effectively no practical method for an attacker to trigger memory corruption, making the likelihood of denial of service or arbitrary code execution negligible.

CVE-2023-47359

A binary hijacking vulnerability exists within the VideoLAN VLC media player before 3.0.19 on Windows. The uninstaller attempts to execute code with elevated privileges out of a standard user writable location. Standard users may use this to gain arbitrary code execution as SYSTEM.

CVE description

Summary: NVD - CVE-2023-46814

Given that the VLC-based component is installed exclusively within air-gapped environments under strict administrative control, the following factors substantially reduce risk:

•	Restricted user access: Only trusted, privileged users perform installations and modifications. Standard users have no write permissions to the uninstaller directory.

•	No internet or network access: The exploit requires local manipulation of VLC’s uninstaller files; without external connectivity, remote coercion or manipulation is impossible.

•	Elimination of attacker vector: In air gapped deployments with administrative controls, un-privileged users cannot place malicious DLLs or executables in the uninstaller’s search path.

•	Minimized privilege escalation risk: The combination of controlled write access, absence of network exposure, and trusted user roles effectively neutralizes the binary hijacking threat, rendering successful exploitation highly unlikely.

CVE-2023-46814

An integer overflow in the VNC module in VideoLAN VLC Media Player through 3.0.17.4 allows attackers, by tricking a user into opening a crafted playlist or connecting to a rogue VNC server, to crash VLC or execute code under some conditions.

CVE description

Summary: NVD - CVE-2022-41325

Camera Connect is deployed exclusively in air-gapped environments with no internet connectivity or external network access, which significantly reduces the risk:

•	No exposure to malicious MKV files: The exploit requires a specially crafted Matroska file. In controlled environments without external media sources, such files cannot be introduced.

•	Remote attack vector eliminated: The vulnerability’s CVSS vector indicates a network-based attack scenario, which is impossible without connectivity.

•	Strict operational controls: Media ingestion is limited to trusted sources under administrative supervision, further minimizing the likelihood of malicious file introduction.

•	Effective risk reduction: These combined factors render exploitation highly improbable, neutralizing the buffer overflow threat.

CVE-2022-41325

A vulnerability in EbmlTypeDispatcher::send in VideoLAN VLC media player 3.0.11 allows attackers to trigger a heap-based buffer overflow via a crafted .mkv file.

CVE description

Summary: NVD - CVE-2020-26664

•	No exposure to malicious ASF files: The exploit requires a specially crafted ASF file. In con-trolled environments without external media sources, such files cannot be introduced.

•	Remote attack vector eliminated: The vulnerability’s CVSS vector indicates a network-based attack scenario, which is impossible without connectivity.

•	Strict operational controls: Media ingestion is limited to trusted sources under administrative supervision, further minimizing the likelihood of malicious file introduction.

•	Effective risk reduction: These combined factors render exploitation highly improbable, neutralizing the buffer overflow threat.

CVE-2020-26664

An off-by-one error in the DecodeBlock function in codec/sdl_image.c in VideoLAN VLC media player before 3.0.9 allows remote attackers to cause a denial of service (memory corruption) via a crafted image file. NOTE: this may be related to the SDL_Image product.

CVE description

Summary: NVD - CVE-2019-19721

CVE-2019-19721

lavc_CopyPicture in modules/codec/avcodec/video.c in VideoLAN VLC media player through 3.0.7 has a heap-based buffer over-read because it does not properly validate the width and height.

CVE description

Summary: NVD - CVE-2019-13962

•	No exposure to malicious MKV files: The exploit requires a specially crafted MKV file. In con-trolled environments without external media sources, such files cannot be introduced.

•	Remote attack vector eliminated: The vulnerability’s CVSS vector indicates a network-based attack scenario, which is impossible without connectivity.

•	Strict operational controls: Media ingestion is limited to trusted sources under administrative supervision, further minimizing the likelihood of malicious file introduction.

•	Effective risk reduction: These combined factors render exploitation highly improbable, neutralizing the buffer overflow threat.

CVE-2019-13962

libebml before 1.3.6, as used in the MKV module in VideoLAN VLC Media Player binaries before 3.0.3, has a heap-based buffer over-read in EbmlElement::FindNextElement.

CVE description

Summary: NVD - CVE-2019-13615

CVE-2019-13615

An Integer Underflow in MP4_EIA608_Convert() in modules/demux/mp4/mp4.c in VideoLAN VLC me-dia player through 3.0.7.1 allows remote attackers to cause a denial of service (heap-based buffer over-flow and crash) or possibly have unspecified other impact via a crafted .mp4 file.

CVE description

Summary: NVD - CVE-2019-13602

CVE-2019-13602

Double Free in VLC versions <= 3.0.6 leads to a crash.

CVE description

Summary: NVD - CVE-2019-5460

CVE-2019-5460

An Integer underflow in VLC Media Player versions < 3.0.7 leads to an out-of-band read.

CVE description

Summary: NVD - CVE-2019-5459

CVE-2019-5459

Improper Restriction of Operations within the Bounds of a Memory Buffer

A Buffer Overflow in VLC Media Player < 3.0.7 causes a crash which can possibly be further developed into a remote code execution exploit.

CVE description

Summary: NVD - CVE-2019-5439

CVE-2019-5439

VideoLAN VLC media player 2.2.x is prone to a use after free vulnerability which an attacker can lever-age to execute arbitrary code via crafted MKV files. Failed exploit attempts will likely result in denial of service conditions.

CVE description

Summary: NVD - CVE-2018-11529

The affected software is deployed exclusively in isolated environments with no internet connectivity and restricted external access. Exploitation of this vulnerability requires a user to open a specially crafted MKV file provided by an attacker. Since the system operates in a controlled network without exposure to untrusted sources, the likelihood of receiving and executing malicious media files is significantly reduced. Additionally, operational procedures can enforce the use of trusted media files only, further minimizing the risk.

CVE-2018-11529

In VideoLAN VLC media player through 2.2.8, there is a type conversion vulnerability in mod-ules/demux/mp4/libmp4.c in the MP4 demux module leading to a invalid free, because the type of a box may be changed between a read operation and a free operation.

CVE description

Summary: NVD - CVE-2017-17670

The affected VLC component is deployed exclusively in fully isolated, air gapped environments with no internet connectivity and tightly controlled external sources. Exploitation of CVE 2017 17670 re-quires a user to open a specifically crafted MP4 file containing a type conversion error in the demuxer. Since the system only processes trusted media files—validated through internal procedures and se-cured media channels—the probability of exposure to hostile MP4 content is minimal. Therefore, the risk of successful exploitation is significantly mitigated by the restricted deployment context.

CVE-2017-17670

avcodec 2.2.x, as used in VideoLAN VLC media player 2.2.7-x before 2017-06-29, allows out-of-bounds heap memory write due to calling memcpy() with a wrong size, leading to a denial of service (application crash) or possibly code execution.

CVE description

Summary: NVD - CVE-2017-10699

No network-based exposure: The vulnerability requires an external actor to supply malicious media content. With no Internet connectivity and presumably controlled file sources, the risk of loading un-trusted files is minimal.

CVE-2017-10699

plugins\audio_filter\libmpgatofixed32_plugin.dll in VideoLAN VLC media player 2.2.4 allows remote attackers to cause a denial of service (invalid read and application crash) or possibly have unspecified other impact via a crafted file.

CVE description

Summary: NVD - CVE-2017-9301

This vulnerability affects the libmpgatofixed32_plugin.dll module in VLC 2.2.4, which is responsible for decoding MPEG audio streams. The software in question does not process audio files or use any functionality related to audio decoding, meaning the vulnerable component is never invoked during normal operation. Additionally, the deployment environment is fully offline with no internet connectivity, and media ingestion is restricted to trusted internal sources.
As a result, the attack surface for this vulnerability is effectively nonexistent, and the risk of exploitation is negligible under these conditions.

CVE-2017-9301

plugins\codec\libflac_plugin.dll in VideoLAN VLC media player 2.2.4 allows remote attackers to cause a denial of service (heap corruption and application crash) or possibly have unspecified other impact via a crafted FLAC file.

CVE description

Summary: NVD - CVE-2017-9300

This vulnerability affects VLC’s FLAC audio processing component. Camera Connect does not handle or process audio files, meaning the vulnerable code path is never executed during normal operation. Combined with the fact that the deployment environment is fully isolated (air gapped) and does not allow external file transfers from untrusted sources, the likelihood of exploitation is effectively eliminated.

CVE-2017-9300

Heap out-of-bound read in ParseJSS in VideoLAN VLC before 2.2.5 due to missing check of string termination allows attackers to read data beyond allocated memory and potentially crash the process via a crafted subtitles file.

CVE description

Summary: NVD - CVE-2017-8313

Even though the affected VLC version (2.2.4) contains this vulnerability, the software is deployed in fully air-gapped environments with no external or internet-facing connectivity. As a result, the likeli-hood of exploiting this vulnerability is extremely low.

CVE-2017-8313

Heap out-of-bound read in ParseJSS in VideoLAN VLC due to missing check of string length allows attackers to read heap uninitialized data via a crafted subtitles file.

CVE description

Summary: NVD - CVE-2017-8312

Because the affected VLC version (2.2.4) suffers from a heap out of bound read in the ParseJSS function—allowing an attacker to read uninitialized heap data via a crafted subtitles file—the risk of external exploitation is significantly reduced in your environment. Since the software is installed in strictly isolated systems with no internet access, no external attacker can deliver malicious subtitle files re-motely. Consequently, the only remaining exposure is local: an insider would need to intentionally load a crafted subtitle file to trigger the issue—a scenario considered highly unlikely under current governance and usage controls.

CVE-2017-8312

Potential heap based buffer overflow in ParseJSS in VideoLAN VLC before 2.2.5 due to skipping NULL terminator in an input string allows attackers to execute arbitrary code via a crafted subtitles file.

CVE description

Summary: NVD - CVE-2017-8311

Since the application is deployed exclusively in isolated, air-gapped environments with no external network connectivity, the attack vector—specifically, the ability for an attacker to deliver a crafted subtitle file—is significantly constrained.

CVE-2017-8311

Heap out-of-bound read in CreateHtmlSubtitle in VideoLAN VLC 2.2.x due to missing check of string termination allows attackers to read data beyond allocated memory and potentially crash the process (causing a denial of service) via a crafted subtitles file.

CVE description

Summary: NVD - CVE-2017-8310

Because your team’s VLC based software is deployed only in isolated environments without internet access, the risk of malicious delivery of crafted subtitle files is greatly diminished. This significantly reduces exploitation likelihood.

CVE-2017-8310


ABB is aware of public reports of vulnerabilities in a 3rd party dependency SQLite Version 3.2.4 which was delivered together with the installation package of Camera Connect Version 2.0.0.42 and below. An update is available that resolves a privately reported outdated 3rd party component with vulnerabilities in the product versions listed as affected in the advisory.

An attacker who successfully exploited any of these vulnerabilities in the 3rd party component could potentially compromise the system in different ways.

Summary

For additional instructions and support please contact your local ABB service organization. For contact information, see www.abb.com/contactcenters.

Information about ABB’s cyber security program and capabilities can be found at www.abb.com/cybersecurity.

Support

The information in this document is subject to change without notice, and should not be construed as a commitment by ABB.

ABB provides no warranty, express or implied, including warranties of merchantability and fitness for a particular purpose, for the information contained in this document, and assumes no responsibility for any errors that may appear in this document. In no event shall ABB or any of its suppliers be liable for direct, indirect, special, incidental or consequential damages of any nature or kind arising from the use of this document, or from the use of any hardware or software described in this document, even if ABB or its suppliers have been advised of the possibility of such damages.

This document and parts hereof must not be reproduced or copied without written permission from ABB, and the contents hereof must not be imparted to a third party nor used for any unauthorized purpose.

All rights to registrations and trademarks reside with their respective owners.

Notice

For any installation of software-related ABB products we strongly recommend the following (non-exhaustive) list of cyber security practices:
- Isolate special purpose networks (e.g. for automation systems) and remote devices behind firewalls and separate them from any general-purpose network (e.g. office or home networks).
- Install physical controls so no unauthorized personnel can access your devices, components, peripheral equipment, and networks.
- Never connect programming software or computers containing programing software to any network other than the network for the devices that it is intended for.
- Scan all data imported into your environment before use to detect potential malware infections.
- Minimize network exposure for all applications and endpoints to ensure that they are not accessible from the Internet unless they are designed for such exposure and the intended use requires such.
- Ensure all nodes are always up to date in terms of installed software, operating system, and firmware patches as well as anti-virus and firewall.
- When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.

General security recommendations

ABB has a rigorous internal cyber security continuous improvement process which involves regular testing with industry leading tools and periodic assessments to identify potential product issues. Occasionally an issue is determined to be a design or coding flaw with implications that may impact product cyber security.

When a potential product vulnerability is identified or reported, ABB immediately initiates our vulnerability handling process. This entails validating if the issue is in fact a product issue, identifying root causes, determining what related products may be impacted, developing a remediation, and notifying end users and governmental organizations.

The resulting Cyber Security Advisory intends to notify customers of the vulnerability and provide details on which products are impacted, how to mitigate the vulnerability or explain workarounds that minimize the potential risk as much as possible. The release of a Cyber Security Advisory should not be misconstrued as an affirmation or indication of an active threat or ongoing campaign targeting the products mentioned here. If ABB is aware of any specific threats, it will be clearly mentioned in the communication.

The publication of this Cyber Security Advisory is an example of ABB’s commitment to the user community in support of this critical topic. Responsible disclosure is an important element in the chain of trust we work to maintain with our many customers. The release of an Advisory provides timely information which is essential to help ensure our customers are fully informed.

Purpose

What causes the vulnerability?
- The vulnerabilities are caused by the use of SQLite version 3.2.4 in Camera Connect versions up to 2.0.0.42. The root causes vary and are presented in the CVEs in the previous section.

What is the affected product or component?
- The affected component is SQLite version 3.2.4, which is an embedded relational database engine used by Camera Connect versions up to 2.0.0.42.

What might an attacker use the vulnerability to do?
- The potential impacts vary depending on the specific CVE and each one of them are discussed in the previous sections however, it's important to note that the actual exploitability and impact are significantly reduced by Camera Connect's deployment in isolated OT networks with restricted access controls.

How could an attacker exploit the vulnerability?
- Exploitation methods vary by CVE but generally fall into these categories:
     1. Database Query Manipulation (Most Common)
     2. Database Schema Manipulation (Administrative Access Required)
     3. Malformed Database Files
     4. Extension-Specific Attacks

   Exploitation Barriers in Camera Connect Deployments:
     - No direct SQL query interface exposed to users
     - Parameterized queries and input validation reduce injection risks
     - Database administrative operations restricted to installation/upgrade processes
     - Network segmentation limits attacker access to the system
     - Authentication and authorization controls restrict unauthorized access

Could the vulnerability be exploited remotely?
- In properly configured Camera Connect deployments following industrial security best practices, remote exploitation is highly unlikely.

   While the CVEs may reference remote exploitation, Camera Connect's architecture and typical OT deployment model make remote exploitation from outside the control network perimeter extremely difficult. The primary threat vectors are from malicious insiders or compromised systems already within the control network.

Can functional safety be affected by an exploit of this vulnerability?
- While exploitation of these vulnerabilities could degrade operational monitoring capabilities, properly designed industrial facilities maintain functional safety through independent, dedicated safety systems. Camera Connect should be considered an operational support tool rather than a safety-critical component. Organizations should ensure their safety management systems do not create dependencies on Camera Connect for safety-instrumented functions.

What does the update do?
- The update removes the vulnerability by providing a newer version of the affected component.

When this security advisory was issued, had this vulnerability been publicly disclosed?
- This vulnerability has been publicly disclosed for the 3rd party component, but not for the ABB product using this component

When this security advisory was issued, had ABB received any reports that this vulnerability was being exploited?
- No, ABB had not received any information indicating that this vulnerability had been exploited when this security advisory was originally issued.

Frequently Asked Questions

ABB Ability Camera Connect Vulnerabilities in outdated 3rd party component (SQLite 3.2.4)

Summary: Initial version.

A vulnerability was found in SQLite SQLite3 up to 3.43.0 and classified as critical. This issue affects the function sessionReadRecord of the file ext/session/sqlite3session.c of the component make alltest Handler. The manipulation leads to heap-based buffer overflow. It is recommended to apply a patch to fix this issue.

CVE description

Summary: NVD - CVE-2023-7104

The problem is corrected in the following product versions:
- ABB Ability Camera Connect 2.0.0.49.
The easiest path to mitigate the problem is an update of ABB Ability Camera Connect system by the customer. ABB recommends that customers apply the update at earliest convenience.

This vulnerability affects the SQLite session extension (FTS3), which is an optional component:
- Component Usage: Camera Connect's implementation do not utilize the SQLite session extension functionality, rendering this vulnerability non-applicable to the actual deployment.
- Adjacent Network Attack: The CVSS vector indicates Adjacent Network access (AV:A) is required, meaning the attacker must be on the same local network segment. In OT environments, network segmentation at ISA-95 Level 2 restricts access to authorized personnel only.
- Authentication Required: Low privilege credentials (PR:L) are still required to exploit this vulnerability, providing an additional barrier in Camera Connect's access-controlled environment.
- Limited Impact: The CVSS score of 5.5 (MEDIUM) reflects limited impact to confidentiality, integrity, and avail-ability (C:L/I:L/A:L).
- Extension-Specific: The vulnerability is in the make all test handler of the session extension, which is typically not used in production deployments.

Camera Connect's restricted operational environment and limited use of optional SQLite features significantly reduce the exploitability of this vulnerability.

CVE-2023-7104

SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a string argument to a C API.

CVE description

Summary: NVD - CVE-2022-35737

This vulnerability has specific prerequisites that limit its applicability to Camera Connect:
- Resource Requirements: The vulnerability requires "billions of bytes" to be used in a string argument, representing an extreme edge case that exceeds typical operational parameters in industrial control systems.
- C API Specific: This vulnerability affects direct C API calls to SQLite. Camera Connect uses higher-level database access patterns through managed code or SQL queries, not direct low-level C API manipulation.
- Memory Constraints: Industrial systems running Camera Connect typically operate within defined memory boundaries and resource allocation limits that would prevent the allocation of multi-gigabyte strings.
- Input Validation: Application-level input validation and size restrictions in Camera Connect prevent the sub-mission of abnormally large data values.
- Practical Impossibility: In the context of Camera Connect's use case (camera connectivity and video management), there are no legitimate operational scenarios requiring billion-byte string parameters.

The extreme resource requirements and specific attack vector make this vulnerability impractical to exploit in Camera Connect's typical deployment environment.

CVE-2022-35737

In SQLite before 3.32.3, select.c mishandles query-flattener optimization, leading to a multiSelectOrderBy heap over-flow because of misuse of transitive properties for constant propagation.

CVE description

Summary: NVD - CVE-2020-15358

This vulnerability involves specific SQL query patterns and optimization edge cases:
- Query Complexity: The vulnerability requires specific use of complex multi-select queries with ORDER BY clauses that trigger the query-flattener optimization. Camera Connect's database queries are typically straight-forward CRUD operations for camera configuration and video metadata.
- Limited Query Construction: Users of Camera Connect do not have direct SQL query construction capabilities; all database interactions occur through the application's predefined data access layer.
- Query Review: Database queries in Camera Connect are part of the application codebase and undergo development review and testing, reducing the likelihood of crafted malicious query patterns.
- Heap Overflow Protection: Modern operating systems and runtime environments include heap overflow protection mechanisms that can detect and prevent exploitation attempts.
- Operational Context: The specific query pattern required to trigger this vulnerability is unlikely to occur in Camera Connect's operational use cases related to camera management and video streaming.

The constrained database access model and typical query patterns in Camera Connect operations make this vulnerability extremely unlikely to be triggered in practice.

CVE-2020-15358

ext/fts3/fts3_snippet.c in SQLite before 3.32.0 has a NULL pointer dereference via a crafted matchinfo() query.

CVE description

Summary: NVD - CVE-2020-13632

This vulnerability affects the SQLite Full-Text Search (FTS3) extension with specific conditions:
- FTS3 Extension: Camera Connect do not utilize SQLite's Full-Text Search capabilities, as the solution is primarily focused on camera connectivity, configuration, and video management rather than full-text search operations.
- Specific Function: The vulnerability requires use of the matchinfo() function, which is a specialized FTS3 query function which is not part of Camera Connect's database access patterns.
- Denial of Service Impact: This is a NULL pointer dereference leading to application crash (denial of service), not remote code execution. In an OT environment, application crashes are detected and can trigger automatic restart mechanisms.
- Access Control: Crafting the specific malicious query would require authenticated database access and knowledge of the database schema.
- Feature-Specific: The FTS3 is not enabled or compiled into the SQLite build used by Camera Connect, so this vulnerability is not present.

The specialized nature of this vulnerability and its limitation to a specific extension function that Camera Connect likely does not utilize significantly reduces the risk.

CVE-2020-13632

SQLite before 3.32.0 allows a virtual table to be renamed to the name of one of its shadow tables, related to alter.c and build.c.

CVE description

Summary: NVD - CVE-2020-13631

This vulnerability involves database schema manipulation:
- Administrative Privilege Requirement: Renaming tables requires database administrative privileges, which are not granted to normal Camera Connect users.
- Virtual Table Usage: This vulnerability specifically affects virtual tables, which are an advanced SQLite feature. Camera Connect's database schema uses standard tables for its operational data.
- Schema Stability: In industrial OT environments, database schemas are static and controlled through formal change management processes. Dynamic table creation and renaming are not typical operational activities.
- Limited Impact: Even if exploited, the impact is primarily on database integrity rather than system availability or confidentiality. Database backups and recovery procedures in industrial environments provide restoration capabilities.
- Application Logic: Camera Connect's application layer mediates all database interactions, preventing direct DDL (Data Definition Language) operations by end users.

The requirement for administrative access and the uncommon use case of dynamic schema modification in OT environments make this vulnerability low risk for Camera Connect.

CVE-2020-13631

ext/fts3/fts3.c in SQLite before 3.32.0 has a use-after-free in fts3EvalNextRow, related to the snippet feature.

CVE description

Summary: NVD - CVE-2020-13630

This is another FTS3 extension-specific vulnerability:
- FTS3 Extension Dependency: The vulnerability exists only in the FTS3 (Full-Text Search) extension. Camera Connect does not enable or use FTS3 functionality, so this vulnerability is not applicable.
- Snippet Feature: The use-after-free specifically affects the snippet feature of FTS3, which generates text snip-pets from search results - a specialized feature unlikely to be required in Camera Connect's video management operations.
- Memory Management: Modern operating systems and runtime environments include heap management protections that can detect use-after-free conditions and prevent exploitation.
- Crash vs. Exploitation: While use-after-free vulnerabilities can potentially lead to code execution, successful exploitation requires precise memory manipulation. The more likely outcome is application crash (denial of service).
- Function-Specific: The vulnerability is in fts3EvalNextRow, a specific internal function that would only be triggered through specialized FTS3 queries.

Camera Connect's non-existent use of advanced FTS3 features significantly reduces exposure to this vulnerability.

CVE-2020-13630

SQLite through 3.32.0 has a segmentation fault in sqlite3ExprCodeTarget in expr.c.

CVE description

Summary: NVD - CVE-2020-13435

This vulnerability results in a segmentation fault (application crash):
- Denial of Service Impact: A segmentation fault leads to application crash, representing a denial of service rather than data breach or code execution. In industrial environments, application monitoring and automatic re-start mechanisms can quickly restore service.
- Query Complexity: The vulnerability requires specific expression patterns in SQL queries. Camera Connect's predefined query templates and parameterized queries reduce the likelihood of triggering this condition.
- High Availability Design: OT solutions typically incorporate redundancy and failover mechanisms to maintain operational continuity in the event of application failures.
- Limited Window: In a segmentation fault scenario, the application terminates immediately, limiting any potential data exposure compared to vulnerabilities that allow sustained unauthorized access.
- Operational Monitoring: Industrial control systems maintain operational monitoring that alerts operators to application failures, enabling rapid response.

While denial of service is undesirable in OT environments, the impact is significantly less severe than vulnerabilities allowing unauthorized access or data manipulation.

CVE-2020-13435

SQLite through 3.32.0 has an integer overflow in sqlite3_str_vappendf in printf.c.

CVE description

Summary: NVD - CVE-2020-13434

This vulnerability affects SQLite's internal printf functionality:
- Internal Function: The vulnerability is in sqlite3_str_vappendf, an internal string formatting function. Camera Connect's use of SQLite typically occurs through higher-level database operations that don't directly expose this function.
- Integer Overflow Requirements: Triggering an integer overflow requires carefully crafted input with extreme values, which would be constrained by Camera Connect's input validation and data type definitions.
- Format String Context: The vulnerability occurs in printf-style formatting operations. Camera Connect's data-base interactions use parameterized queries and typed data binding rather than format string operations.
- Bounds Checking: Application-level data validation limits the size and format of values passed to database operations, preventing the extreme conditions necessary to trigger this overflow.
- Limited Exposure: The specific code path would need to be triggered through very specific database operations that may not occur in Camera Connect's normal operational workflow.

The internal nature of this vulnerability and Camera Connect's structured data access patterns make exploitation highly unlikely in practice.

CVE-2020-13434

In SQLite through 3.31.1, the ALTER TABLE implementation has a use-after-free, as demonstrated by an ORDER BY clause that belongs to a compound SELECT statement.

CVE description

Summary: NVD - CVE-2020-11656

This vulnerability involves database schema modification operations:
- Schema Modification: The vulnerability is in ALTER TABLE operations. In OT environments, database schemas are static and managed through controlled change management processes, not dynamic runtime modifications.
- Administrative Operation: ALTER TABLE requires elevated database privileges that are not granted to regular Camera Connect users or operational personnel.
- Compound Query Requirement: The vulnerability specifically requires a compound SELECT statement with ORDER BY clause in the context of ALTER TABLE - an unusual and non-standard SQL pattern.
- Application-Mediated Access: Camera Connect does not provide interfaces for direct SQL execution or schema modification to end users.
- Static Schema: Camera Connect's database schema is established during installation and remains stable throughout operational use, with updates only occurring during planned software upgrades.

The administrative nature of ALTER TABLE operations and the absence of dynamic schema modification in normal Cam-era Connect usage effectively eliminate this attack vector.

CVE-2020-11656

SQLite through 3.31.1 allows attackers to cause a denial of service (segmentation fault) via a malformed window-function query because the AggInfo object's initialization is mishandled.

CVE description

Summary: NVD - CVE-2020-11655

This vulnerability involves SQL window functions:
- Window Function Usage: Window functions (e.g., ROW_NUMBER(), RANK(), LAG()) are advanced SQL features primarily used in analytical queries. Camera Connect's operational database queries typically use simpler CRUD operations and aggregations.
- Denial of Service Only: The impact is a segmentation fault causing application crash, not data breach or code execution. In industrial environments, service interruption is managed through monitoring and automatic restart capabilities.
- Query Complexity: Crafting a malformed window function query requires knowledge of the database schema and specific query construction - not accessible through Camera Connect's standard user interfaces.
- Controlled Environment: In ISA-95 Level 2 deployments, any application crashes are immediately visible to operators and can be investigated through system logs and monitoring.
- Feature Utilization: Camera Connect's queries do not utilize window functions, so this attack vector is not present in the application.

The specialized nature of window functions and the controlled operational environment limit the practical impact of this vulnerability.

CVE-2020-11655

Improper Check for Unusual or Exceptional Conditions

pragma.c in SQLite through 3.30.1 mishandles NOT NULL in an integrity_check PRAGMA command in certain cases of generated columns.

CVE description

Summary: NVD - CVE-2019-19646

This vulnerability involves SQLite's PRAGMA commands and generated columns:
- PRAGMA Commands: PRAGMA commands are administrative database commands typically not accessible to end users. Camera Connect's application layer would not expose PRAGMA command execution to operators.
- Integrity Check Context: The vulnerability specifically affects the integrity_check PRAGMA, which is a database maintenance operation typically performed during development or maintenance windows, not during normal operation.
- Limited Impact: Mishandling of NOT NULL in integrity checks would primarily affect database validation results rather than causing security breaches or service disruption.
- Administrative Access Required: Execution of PRAGMA commands requires direct database access at an ad-ministrative level, which is restricted in production OT environments.

The specialized nature of this vulnerability and its limitation to administrative database maintenance operations make it non-applicable to Camera Connect's normal operational use.

CVE-2019-19646

alter.c in SQLite through 3.30.1 allows attackers to trigger infinite recursion via certain types of self-referential views in conjunction with ALTER TABLE statements.

CVE description

Summary: NVD - CVE-2019-19645

This vulnerability involves database views and schema modification:
- View Usage: This vulnerability requires self-referential database views, which are advanced database con-structs. Camera Connect's database schema uses standard tables and simple views without self-referential patterns.
- ALTER TABLE Requirement: Triggering the vulnerability requires ALTER TABLE operations, which are administrative schema modification commands not available to normal users.
- Infinite Recursion Detection: Modern operating systems and runtime environments typically include stack overflow protection and recursion detection that can terminate runaway processes.
- Schema Design: Self-referential views represent poor database design practices that would be identified and corrected during development review.
- Static Schema: Camera Connect's database schema is static and managed through formal change control, pre-venting the introduction of problematic self-referential view patterns.

The requirement for both specialized view design and administrative schema modification makes this vulnerability in-applicable to Camera Connect's operational environment.

CVE-2019-19645

SQLite before 3.25.3, when the FTS3 extension is enabled, encounters an integer overflow (and resultant buffer over-flow) for FTS3 queries in a "merge" operation that occurs after crafted changes to FTS3 shadow tables, allowing remote attackers to execute arbitrary code by leveraging the ability to run arbitrary SQL statements (such as in certain WebSQL use cases). This is a different vulnerability than CVE-2018-20346.

CVE description

Summary: NVD - CVE-2018-20506

This vulnerability affects the FTS3 extension with specific attack requirements:
- FTS3 Extension: Camera Connect do not utilize the Full-Text Search extension, making this vulnerability non-applicable.
- Shadow Table Manipulation: The vulnerability requires crafted changes to FTS3 "shadow tables" (internal tables supporting FTS3 indexes). These shadow tables are not exposed through normal database operations and require direct low-level database access.
- Multi-Step Attack: Exploitation requires multiple steps: enable FTS3, manipulate shadow tables, and then trig-ger a merge operation - each requiring specific database access and knowledge.
- ISA-95 Level 2 Deployment: The "remote attackers" scenario is mitigated by network segmentation. Camera Connect operates in isolated control networks without direct internet exposure.

The combination of FTS3-specific requirements, shadow table manipulation, and network isolation makes this vulnerability low risk for Camera Connect deployments.

CVE-2018-20506

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

SQLite 3.25.2, when queries are run on a table with a malformed PRIMARY KEY, allows remote attackers to cause a denial of service (application crash) by leveraging the ability to run arbitrary SQL statements (such as in certain WebSQL use cases).

CVE description

Summary: NVD - CVE-2018-20505

This vulnerability is classified as CWE-89 (SQL Injection) in NVD, but exploitation still requires SQL execution paths that are not exposed in normal Camera Connect operation:
- Database Schema Validation: Camera Connect's database schema is established during installation and vali-dated through testing. A malformed PRIMARY KEY would be detected during development and corrected be-fore deployment.
- DDL Access: Creating or modifying PRIMARY KEY constraints requires database administrative privileges and DDL (Data Definition Language) access, which is not available to normal Camera Connect users.
- SQL Injection Controls: Camera Connect uses parameterized queries and controlled query templates, which significantly reduce the likelihood of user-controlled SQL construction required for SQL injection exploitation.
- Denial of Service Impact: The vulnerability leads to application crash rather than data breach or code execution. Industrial environments include application monitoring and automatic restart capabilities to maintain service availability.
- Static Schema: Camera Connect's database schema remains static throughout operational use, with PRIMARY KEY definitions established and validated during initial installation.

The combination of SQL injection controls, restricted DDL access, and static schema management makes this vulnerability low risk in properly deployed Camera Connect systems.

CVE-2018-20505

SQLite before 3.25.3, when the FTS3 extension is enabled, encounters an integer overflow (and resultant buffer over-flow) for FTS3 queries that occur after crafted changes to FTS3 shadow tables, allowing remote attackers to execute arbitrary code by leveraging the ability to run arbitrary SQL statements (such as in certain WebSQL use cases), aka Magellan.

CVE description

Summary: NVD - CVE-2018-20346

This is the "Magellan" vulnerability, related to CVE-2018-20506:
- FTS3 Extension: The vulnerability only affects installations where the FTS3 (Full-Text Search) extension is enabled. Camera Connect do not require or enable this extension.
- Shadow Table Manipulation: Exploitation requires direct manipulation of FTS3 shadow tables, which are in-ternal implementation details not exposed through standard SQL interfaces.
- Arbitrary SQL Execution: The attack requires the "ability to run arbitrary SQL statements." Camera Connect uses parameterized queries and does not provide SQL injection points or direct SQL execution capabilities to users.
- OT Network Isolation: The "remote attackers" threat model is mitigated by ISA-95 Level 2 network segmentation, which isolates the control network from external access.
- Multi-Stage Attack: Successful exploitation requires multiple prerequisites: FTS3 enabled, ability to modify shadow tables, and ability to execute queries - each representing a significant barrier.

The specialized attack requirements and Camera Connect's deployment architecture make this high-profile vulnerability low risk in practice.

CVE-2018-20346

In SQLite through 3.22.0, databases whose schema is corrupted using a CREATE TABLE AS statement could cause a NULL pointer dereference, related to build.c and prepare.c.

CVE description

Summary: NVD - CVE-2018-8740

This vulnerability involves database schema corruption:
- Schema Corruption: The vulnerability requires a corrupted database schema created via a CREATE TABLE AS statement. Camera Connect's database schema is established through controlled installation processes with validation and integrity checks.
- DDL Access: CREATE TABLE statements require database administrative privileges, which are not available to normal Camera Connect users or operators.
- NULL Pointer Dereference: The impact is a NULL pointer dereference causing application crash (denial of service), not data breach or code execution.
- Database Integrity: Modern database deployments include integrity checking mechanisms that can detect corrupted schemas. Camera Connect likely includes database validation during startup.
- Backup and Recovery: Industrial OT environments maintain database backups and recovery procedures that can restore a clean database schema if corruption is detected.

The requirement for database administrative access and the protective mechanisms around database schema integrity make this vulnerability low priority for Camera Connect deployments.

CVE-2018-8740

The getNodeSize function in ext/rtree/rtree.c in SQLite through 3.19.3, as used in GDAL and other products, mishandles undersized RTree blobs in a crafted database, leading to a heap-based buffer over-read or possibly unspecified other impact.

CVE description

Summary: NVD - CVE-2017-10989

This vulnerability affects SQLite's R Tree extension:
- R Tree Extension: This vulnerability is specific to the RTree (R-Tree spatial index) extension of SQLite. Camera Connect do not utilize spatial indexing capabilities, making this extension inactive.
- Crafted Database Requirement: The vulnerability requires a specially crafted database with malformed RTree blobs. Camera Connect's database is generated and maintained by the application itself, not loaded from ex-ternal sources.
- Spatial Data: RTree indexes are used for spatial data queries (geographic/geometric data). Camera Connect's use case involves camera management and video streaming, which typically does not require spatial indexing.
- Limited Exposure: The vulnerability requires both the RTree extension to be enabled and specific malformed data structures within the database.
- Database Source Control: In OT environments, databases come from trusted sources and are protected by integrity checking mechanisms.

Camera Connect does not use the RTree extension, so this vulnerability is not applicable. Even if the extension is pre-sent, the controlled database environment significantly reduces risk.

CVE-2017-10989

os_unix.c in SQLite before 3.13.0 improperly implements the temporary directory search algorithm, which might allow local users to obtain sensitive information, cause a denial of service (application crash), or have unspecified other im-pact by leveraging use of the current working directory for temporary files.

CVE description

Summary: NVD - CVE-2016-6153

This vulnerability affects temporary file handling on Unix-based systems:
- Windows Deployment: Camera Connect is primarily deployed on Windows operating systems in industrial environments (note: the vulnerability description specifically references os_unix.c). Windows-based deployments are not affected by this Unix-specific implementation issue.
- Local Access Required: The CVE describes "local users" as the threat actors, requiring authenticated local sys-tem access. In OT environments, local system access is restricted to authorized administrators.
- Temporary File Usage: The vulnerability relates to temporary file creation. Modern SQLite versions and Camera Connect's configuration may specify explicit temporary directory locations rather than relying on the de-fault search algorithm.
- File System Permissions: Windows operating systems used in industrial environments typically implement proper file system permissions and user access controls.
- Sensitive Information Exposure: Any sensitive information in temporary files would be limited to transient database operations and would not include long-term sensitive data.

The Unix-specific nature of this vulnerability and Camera Connect's typical deployment on Windows systems significantly reduces applicability.

CVE-2016-6153

SQLite before 3.8.9, as used in Android before 5.1.1 LMY48T, allows attackers to gain privileges via a crafted application, aka internal bug 20099586.

CVE description

Summary: NVD - CVE-2015-6607

Summary:
NVD CVSS v2.0 Calculator
- CVSS v2.0 Vector : AV:N/AC:M/Au:N/C:P/I:P/A:P
- CVSS v2.0 Base Score : 6.8

This vulnerability is specific to Android environments:
- Platform-Specific: This CVE specifically affects Android operating systems (before version 5.1.1 LMY48T). Camera Connect is a Windows-based application for industrial environments, not an Android mobile application.
- Different Attack Surface: The vulnerability involves Android's application sandbox and privilege model, which is fundamentally different from Windows desktop application security.
- Application Context: As noted in the CVE description, it's "internal bug 20099586" - an Android-specific internal vulnerability in how Android handled SQLite.
- Non-Applicable Platform: Since Camera Connect operates on Windows systems in OT environments rather than Android mobile devices, this CVE does not apply to Camera Connect deployments.

This CVE is effectively not relevant to Camera Connect due to platform incompatibility.

CVE-2015-6607

Multiple unspecified vulnerabilities in SQLite before 3.8.10.2, as used in Apple iOS before 9, have unknown impact and attack vectors.

CVE description

Summary: NVD - CVE-2015-5895

Summary:
NVD CVSS v2.0 Calculator
- CVSS v2.0 Vector : AV:N/AC:L/Au:N/C:C/I:C/A:C
- CVSS v2.0 Base Score : 10

This CVE has limited public information:
- Platform-Specific Context: these vulnerabilities were identified and fixed in the context of mobile iOS devices. Camera Connect operates on Windows platforms in industrial environments.
- Unspecified Details: The CVE notes "unspecified vulnerabilities" with "unknown impact and attack vectors," suggesting these may be vendor-specific issues in Apple's SQLite implementation or integration rather than core SQLite vulnerabilities.
- Mobile vs. Desktop: iOS and desktop Windows environments have fundamentally different security models, application sandboxing, and attack surfaces.
- Apple-Specific Fixes: These vulnerabilities were addressed in iOS 9 through Apple-specific patches, which may have included iOS-specific security hardening rather than core SQLite fixes.
- Limited Applicability: Without specific attack vector information, and given the iOS-specific context, there is insufficient evidence that these vulnerabilities affect Camera Connect on Windows platforms.

The mobile platform-specific nature and lack of detailed vulnerability information make risk assessment and mitigation difficult, but the platform differences suggest limited applicability.

CVE-2015-5895

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Multiple buffer overflows in the printf functionality in SQLite, as used in Apple iOS before 8.4 and OS X before 10.10.4, allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via unspecified vectors.

CVE description

Summary: NVD - CVE-2015-3717

Summary:
NVD CVSS v2.0 Calculator
- CVSS v2.0 Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P
- CVSS v2.0 Base Score : 7.5

This vulnerability affects printf functionality in Apple platforms:
- Apple Platform Context: The CVE specifically references Apple iOS and OS X implementations. Camera Connect runs on Windows operating systems, which may have different SQLite implementations and security controls.
- Printf Functionality: The vulnerability is in printf functionality, which is internal string formatting. Camera Connect uses parameterized database queries and typed data operations, limiting exposure to format string vulnerabilities.
- Remote Attackers: The CVE mentions "remote attackers," but Camera Connect operates in isolated ISA-95 Level 2 networks with no direct remote access from the internet.
- Apple-Specific Fixes: The vulnerability was addressed through Apple platform-specific security updates, which may have included platform-specific protections not present in or needed for Windows deployments.
- String Handling: Modern development practices in Camera Connect likely use safe string handling APIs and input validation that reduce exposure to buffer overflow conditions.

The Apple platform-specific nature of this CVE and Camera Connect's Windows deployment environment suggest limited cross-platform applicability.

CVE-2015-3717

The sqlite3VXPrintf function in printf.c in SQLite before 3.8.9 does not properly handle precision and width values during floating-point conversions, which allows context-dependent attackers to cause a denial of service (integer over-flow and stack-based buffer overflow) or possibly have unspecified other impact via large integers in a crafted printf function call in a SELECT statement.

CVE description

Summary: NVD - CVE-2015-3416

This vulnerability involves printf-style formatting in SQL SELECT statements:
- Query Control: The vulnerability requires crafting specific printf function calls with very large integer precision/width values within SELECT statements. Camera Connect's SQL queries are generated by the application code, not provided directly by untrusted users.
- Input Validation: Any user inputs that influence query parameters undergo validation and sanitization before being incorporated into SQL statements, limiting the ability to inject malicious printf patterns.
- Parameterized Queries: Camera Connect uses parameterized queries and prepared statements where possible, reducing exposure to SQL injection vectors that could be used to introduce malicious printf calls.
- Limited printf Usage: The vulnerability specifically affects printf-style formatting functions in SQLite. Camera Connect's typical query patterns do not extensively use printf-style formatting operations.
- Stack Overflow Detection: Modern compiler protections (stack canaries, ASLR) and operating system safe-guards provide additional defense-in-depth against stack-based buffer overflow exploitation.

The controlled nature of SQL query generation in Camera Connect, combined with input validation and parameterized query usage, significantly reduces the practical exploitability of this vulnerability in production deployments.

CVE-2015-3416

The sqlite3VdbeExec function in vdbe.c in SQLite before 3.8.9 does not properly implement comparison operators, which allows context-dependent attackers to cause a denial of service (invalid free operation) or possibly have unspecified other impact via a crafted CHECK clause, as demonstrated by CHECK(0&O>O) in a CREATE TABLE statement.

CVE description

Summary: NVD - CVE-2015-3415

This vulnerability involves malformed CHECK constraints that can trigger improper resource release behavior (CWE-404):
- CHECK Constraint: The vulnerability requires a malformed CHECK constraint in a CREATE TABLE statement, such as CHECK(0&O>O). CHECK constraints are part of database schema definition, not runtime queries.
- DDL Access Required: Creating or modifying tables with CHECK constraints requires database administrative privileges and DDL access, which is not available to normal Camera Connect users.
- Schema Validation: Camera Connect's database schema is established during installation and undergoes vali-dation testing. Malformed CHECK constraints would be identified and corrected during development.
- Static Schema: Camera Connect uses a predefined database schema that is not dynamically generated or modified during normal operation. New table creation does not occur during runtime.
- Development Detection: The specific CHECK constraint pattern (bitwise operation in comparison) is clearly malformed and would be detected by code review and database testing procedures.
- DoS Containment: Even if triggered, impact is typically process-level instability (invalid free/crash). OT deployments mitigate this with service monitoring, restart policies, and incident response procedures.

The requirement for schema-level modification access and the static nature of Camera Connect's database design effectively eliminate this vulnerability in deployed systems.

CVE-2015-3415

There exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregate terms could exceed the number of columns available. This could lead to a memory corruption issue. We recommend upgrading to version 3.50.2 or above.

CVE description

Summary: NVD - CVE-2025-6965

Summary:
FIRST CVSS v4.0 Calculator
- CVSS v4.0 Vector : AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:H/VA:L/SC:L/SI:H/SA:L/S:N/AU:N/R:U/V:D/RE:L/U:Green
- CVSS v4.0 Base Score : 7.2

Camera Connect is deployed as an OT solution typically operating in ISA-95 Level 2 (control/supervisory level) environments. This deployment architecture provides inherent risk mitigation:
- Network Segmentation: The solution operates within isolated industrial control networks, separated from IT networks and the internet by firewalls and demilitarized zones (DMZs).
- Access Control: Access to the Camera Connect system is restricted to authorized plant operators and maintenance personnel through role-based access controls and authentication mechanisms.
- Limited Attack Surface: The CVSS v4.0 vector indicates Network attack vector (AV:N), High attack complexity (AC:H), and requires Low privileges (PR:L), significantly reducing the likelihood of exploitation in a controlled OT environment.
- Physical Security: Level 2 systems are typically located in secure facilities with physical access controls.
- Operational Monitoring: Industrial environments maintain operational monitoring that can detect anomalous behavior.

Given these factors, successful exploitation would require an authenticated attacker with specific knowledge of the system, positioned within the control network, making this vulnerability Low risk in properly segmented OT deployments.

CVE-2025-6965

An integer overflow can be triggered in SQLite's concat_ws() function. The resulting, truncated integer is then used to allocate a buffer. When SQLite then writes the resulting string to the buffer, it uses the original, untruncated size and thus a wild heap buffer overflow of size ~4GB can be triggered. This can result in arbitrary code execution.

CVE description

Summary: NVD - CVE-2025-3277

Summary:
FIRST CVSS v4.0 Calculator
- CVSS v4.0 Vector : AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L
- CVSS v4.0 Base Score : 6.9

While this vulnerability has a CVSS v4.0 score of 6.9 and theoretically allows arbitrary code execution, Camera Connect's deployment model provides significant protection:
- Function-Specific Vulnerability: The vulnerability requires specific use of the concat_ws() SQL function, which is not utilized in Camera Connect's standard database operations.
- Input Validation: Camera Connect implements input validation and sanitization mechanisms that limit the ability to craft malicious SQL queries.
- Network Isolation: As an ISA-95 Level 2 OT solution, Camera Connect operates within protected industrial networks with limited external connectivity.
- Authenticated Access Required: Database operations in Camera Connect require user authentication and are performed within the context of the application's business logic rather than through direct user-supplied SQL.
- Memory Protection: Modern operating systems deployed in industrial environments typically include memory protection mechanisms (DEP, ASLR) that make heap exploitation more difficult.

The risk is further reduced by operational procedures requiring change management and validation testing before any modifications to the system configuration or database queries.

CVE-2025-3277


Summary: responsibly disclosing the vulnerabilities and providing valuable input on product improvements.

ABB became aware of vulnerability in the products versions listed as affected in the advisory. An update is available that resolves the reported vulnerabilities.

AWIN gateways are not intended to be internet-facing.

An attacker who successfully exploited this vulnerability could take remote control of the product and reboot the device, potentially causing a denial of service. It can also reveal system specific configuration.

ABB requires, as noted in the User Manual, that AWIN gateways should not be exposed to the internet or any other insecure network.

Note. To exploit this vulnerability the attacker needs access to the AWIN gateways. These gateways are installed on sites which often have perimeter security, and the gateways are installed behind firewalls.

Summary

For additional instructions and support please contact your local ABB service organization. For contact information, see www.abb.com/contactcenters.

Information about ABB’s cyber security program and capabilities can be found at www.abb.com/cybersecurity.

Support

The information in this document is subject to change without notice, and should not be construed as a commitment by ABB.

ABB provides no warranty, express or implied, including warranties of merchantability and fitness for a particular purpose, for the information contained in this document, and assumes no responsibility for any errors that may appear in this document. In no event shall ABB or any of its suppliers be liable for direct, indirect, special, incidental or consequential damages of any nature or kind arising from the use of this document, or from the use of any hardware or software described in this document, even if ABB or its suppliers have been advised of the possibility of such damages.

This document and parts hereof must not be reproduced or copied without written permission from ABB, and the contents hereof must not be imparted to a third party nor used for any unauthorized purpose.

All rights to registrations and trademarks reside with their respective owners.

Notice

For any installation of software-related ABB products we strongly recommend the following (non-exhaustive) list of cyber security practices:

- Isolate special purpose networks (e.g. for automation systems) and remote devices behind firewalls and separate them from any general-purpose network (e.g. office or home networks).
- Install physical controls so no unauthorized personnel can access your devices, components, peripheral equipment, and networks.
- Never connect programming software or computers containing programing software to any network other than the network for the devices that it is intended for.
- Scan all data imported into your environment before use to detect potential malware infections.
- Minimize network exposure for all applications and endpoints to ensure that they are not accessible from the Internet unless they are designed for such exposure and the intended use requires such.
- Ensure all nodes are always up to date in terms of installed software, operating system, and firmware patches as well as anti-virus and firewall.
- When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.

More information on recommended practices can be found in the documents listed in the References section.

General security recommendations

ABB has a rigorous internal cyber security continuous improvement process which involves regular testing with industry leading tools and periodic assessments to identify potential product issues. Occasionally an issue is determined to be a design or coding flaw with implications that may impact product cyber security.

When a potential product vulnerability is identified or reported, ABB immediately initiates our vulnerability handling process. This entails validating if the issue is in fact a product issue, identifying root causes, determining what related products may be impacted, developing a remediation, and notifying end users and governmental organizations.

The resulting Cyber Security Advisory intends to notify customers of the vulnerability and provide details on which products are impacted, how to mitigate the vulnerability or explain workarounds that minimize the potential risk as much as possible. The release of a Cyber Security Advisory should not be misconstrued as an affirmation or indication of an active threat or ongoing campaign targeting the products mentioned here. If ABB is aware of any specific threats, it will be clearly mentioned in the communication.

The publication of this Cyber Security Advisory is an example of ABB’s commitment to the user community in support of this critical topic. Responsible disclosure is an important element in the chain of trust we work to maintain with our many customers. The release of an Advisory provides timely information which is essential to help ensure our customers are fully informed.

Purpose

What causes vulnerability?
- Authentication Bypass due to Improper Session Validation.

What are AWIN Gateways?
- They are WirelessHART gateways. They are intended to be located between level 0 (process) and level 1 (basic control) hierarchy of the IEC 62443 reference model. They collect sensor data and provide this information to the host systems.

What might an attacker use the vulnerability to do?
- An attacker who successfully exploited this vulnerability can render the WirelessHART network unavailable.

How could an attacker exploit the vulnerability?
- An attacker will have to first connect to the same local network where the gateway is present. This vulnerability can be exploited by sending a crafted HTTP GET request using a previously observed or valid time parameter value, regardless of the password used during the initial login attempt.

Could the vulnerability be exploited remotely?
- No. Remote access is disabled in the gateways.

Can functional safety be affected by an exploit of this vulnerability?
- This product is not intended to be used in functional safety applications.

What does the update do?
- It enforces HTTPS access. Unauthenticated requests are explicitly denied. Configuration data is not exposed anymore.

When this security advisory was issued, had this vulnerability been publicly disclosed?
- No, ABB received information about this vulnerability through responsible disclosure.

When this security advisory was issued, had ABB received any reports that this vulnerability was being exploited?
- No, ABB had not received any information indicating that this vulnerability had been exploited when this security advisory was originally issued.

Frequently Asked Questions

Summary: 3BNP102992 : AWIN GW100 User Manual

Summary: 4JNO000308 : AWIN GW120 User Manual

AWIN Gateways Vulnerabilities in Embedded Webserver

Summary: Initial version.

ABB

AWIN

GW100 rev. 2

ABB AWIN Firmware  2.0-0 installed on ABB AWIN GW100 rev. 2  Product ID: 3BNP102988R1

ABB AWIN Firmware  2.0-1 installed on ABB AWIN GW100 rev. 2  Product ID: 3BNP102988R1

ABB AWIN Firmware 1.2-0 installed on ABB AWIN GW120 Product ID 3BNP103003R1

ABB AWIN Firmware 1.2-1 installed on ABB AWIN GW120 Product ID 3BNP103003R1

ABB AWIN Firmware 2.1-0 installed on ABB AWIN GW100 rev. 2  Product ID: 3BNP102988R1

ABB AWIN Firmware  2.0-0 installed on ABB AWIN GW120 Product ID 3BNP103003R1

An unauthenticated query reveals data. Authentication Bypass due to Improper Session Validation.

CVE description

Summary: NVD - CVE-2025-13777

Do the following actions:
- Stop and disconnect any AWIN gateways that are exposed directly to the Internet.
- Ensure that physical controls are in place, so no unauthorized personnel can access your devices, components, peripheral equipment, and networks.
- Ensure that all AWIN gateways are upgraded to the latest firmware version. Please find the latest version of firmware on the respective product Release Notes.
- When remote access is required, only use secure methods.

The problem is corrected in the following product versions:
- AWIN GW100 rev2: v2.1-0
- AWIN GW120: v2.0-0

ABB recommends that customers contact ABB to obtain the updated firmware as soon as possible. ABB Service Support engineer shall apply the firmware update at earliest convenience.

AWIN gateways are NOT internet facing devices and should be installed behind firewalls.

These gateways are intended to be located between level 0 (process) and level 1 (basic control) hierarchy of the IEC 62443 reference model.

Ensure that physical controls are in place, so no unauthorized personnel can access your devices, components, peripheral equipment, and networks.

Update the firmware on the gateways with the newer versions with the fix.

At the time of writing the following versions are latest:
- AWIN GW100 rev2: v2.1-0
- AWIN GW120: v2.0-0

Refer to the Release Notes and Product Bulletins for up-to-date information on the latest firmware re-leases.

CVE-2025-13777

Missing Authentication for Critical Function

An unauthenticated query allows an attacker to remotely reboot the device, potentially causing a denial of service.

CVE description

Summary: NVD - CVE-2025-13778

CVE-2025-13778

An unauthenticated query reveals the system configuration, including sensitive details.

CVE description

Summary: NVD - CVE-2025-13779

CVE-2025-13779