An update is available that resolves internally discovered vulnerabilities in the product versions listed as affected in the advisory.
Depending upon the vulnerability, an attacker with the access to the local network who successfully exploited this vulnerability could escalate the privilege to device admin and take control of the product.

summary

For any installation of software-related ABB products we strongly recommend the following (non-exhaustive) list of cyber security practices:

–	Isolate special purpose networks (e.g. for automation systems) and remote devices behind firewalls and separate them from any general-purpose network (e.g. office or home networks).

–	Install physical controls so no unauthorized personnel can access your devices, components, peripheral equipment, and networks.

–	Never connect programming software or computers containing programing software to any net-work other than the network for the devices that it is intended for.

–	Scan all data imported into your environment before use to detect potential malware infections.

–	Minimize network exposure for all applications and endpoints to ensure that they are not accessible from the Internet unless they are designed for such exposure and the intended use requires such.

–	Ensure all nodes are always up to date in terms of installed software, operating system, and firmware patches as well as anti-virus and firewall.

–	When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.

General security recommendations

For additional instructions and support please contact your local ABB service organization. For contact information, see www.abb.com/contactcenters.
Information about ABB’s cyber security program and capabilities can be found at www.abb.com/cybersecurity.

support

The information in this document is subject to change without notice, and should not be construed as a commitment by ABB.
ABB provides no warranty, express or implied, including warranties of merchantability and fitness for a particular purpose, for the information contained in this document, and assumes no responsibility for any errors that may appear in this document. In no event shall ABB or any of its suppliers be liable for direct, indirect, special, incidental or consequential damages of any nature or kind arising from the use of this document, or from the use of any hardware or software described in this document, even if ABB or its suppliers have been advised of the possibility of such damages.
This document and parts hereof must not be reproduced or copied without written permission from ABB, and the contents hereof must not be imparted to a third party nor used for any unauthorized purpose.
All rights to registrations and trademarks reside with their respective owners.

Notice

Mitigating factors describe conditions and circumstances that make an attack that exploits the vulnerability difficult or less likely to succeed.
Refer to section “General security recommendations” for further advise on how to keep your system secure.

Mitigating factors

Summary: ABB CYBERSECURITY ADVISORY - PDF version

Summary: ABB CYBERSECURITY ADVISORY - CSAF version

ANC – ABB Network Card Multiple vulnerabilities in ANC

Summary: Initial version.

Summary: Added NVD link to all vulnerabilities

An unverified password changes in ANC sw version <= 1.1.4 allows an authenticated attacker to bypass the old Password check in the password change form via a web HMI. Requiring the old password is a common security practice that adds an extra layer of protection against unauthorized changes. Without the need of old password attacker with even a temporary access to user’s session could easily change the password and lock out the legitimate user.
This problem is resolved in sw version 1.1.5.

CVE description

Summary: NVD -CVE-2024-47784

All web HMI related problems (CVE-2024-47784, CVE-2024-9876, CVE-2024-9877) are corrected in the product version 1.1.5.
ABB recommends that customers apply the update at earliest convenience. The process to identify the installed product version and process to install updates is described in the user manual.

CVE-2024-47784

Modification of Assumed-Immutable Data (MAID)

A non-administrative user could gain access to an admin page where they could perform all actions which should be restricted only to an admin user. The vulnerability was due to improper validation in the web HMI server.
This problem is resolved in software version 1.1.5, apply the update at earliest convenience.

CVE description

Summary: NVD -CVE-2024-9876

CVE-2024-9876

Use of GET Request Method With Sensitive Query Strings

A use of GET request method with sensitive query strings vulnerability allows an attacker to view plaintext password, if the attacker is able to read the GET requests to those services.
This problem is resolved in software version 1.1.5, apply the update at earliest convenience.

CVE description

Summary: NVD -CVE-2024-9877

CVE-2024-9877


ABB is aware of public reports of a vulnerability in the product versions listed as affected in this advisory.
An attacker who successfully exploited this vulnerability could cause the product to stop communicating on the IEC 61850 network.

Summary

Support

For any installation of software-related ABB products we strongly recommend the following (non-exhaustive) list of cyber security practices:
–	Isolate special purpose networks (e.g. for automation systems) and remote devices behind firewalls and separate them from any general-purpose network (e.g. office or home networks).
–	Install physical controls so no unauthorized personnel can access your devices, components, peripheral equipment, and networks.
–	Never connect programming software or computers containing programing software to any net-work other than the network for the devices that it is intended for.
–	Scan all data imported into your environment before use to detect potential malware infections.
–	Minimize network exposure for all applications and endpoints to ensure that they are not accessible from the Internet unless they are designed for such exposure and the intended use requires such.
–	Ensure all nodes are always up to date in terms of installed software, operating system, and firmware patches as well as anti-virus and firewall.
–	When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.

General security recommendations

Notice

Mitigating factors describe conditions and circumstances that make an attack that exploits the vulnerability difficult or less likely to succeed.
In case customer cannot opt for not to upgrade the firmware or it is not feasible then please immediately apply mitigating factors mentioned in “General security recommendations”.

Mitigating factors

Ekip Com IEC61850 Vulnerability in 3rd Party Library

Summary: Initial

A vulnerability exists in the 3rd party library included in the product versions listed as affected in this advisory. An attacker could exploit the vulnerability by sending a specially crafted message to the system node, causing the node to stop or become inaccessible.

CVE Description

Summary: NVD CVE-2022-38138

The problem is corrected in the product versions:
Ekip Com IEC61850 version 3.08
ABB advises users of the affected product versions to reach out to their local ABB support team for guidance and recommended actions.
Additionally, ABB recommends implementing defensive measures to reduce the risk of vulnerability exploitation, as outlined in the product instruction manual. Please refer to the section “Mitigation factors” for more information.

CVE-2022-38138


ABB became aware of an internally discovered vulnerability in the Lite Panel Pro product listed as affected in the advisory.

An attacker with access to local network who successfully exploits the vulnerability could have unauthorized access during a limited time window.

ABB strongly advises customers to update Lite Panel Pro with latest firmware version available at official
product website.

summary

For any installation of software-related ABB products we strongly recommend the following (non-exhaustive) list of cyber security practices:
- Isolate special purpose networks (e.g. for automation systems) and remote devices behind firewalls and separate them from any general-purpose network (e.g. office or home networks).
- Install physical controls so no unauthorized personnel can access your devices, components, peripheral equipment, and networks.
- Never connect programming software or computers containing programming software to any
network other than the network for the devices that it is intended for.
- Scan all data imported into your environment before use to detect potential malware infections.
- Minimize network exposure for all applications and endpoints to ensure that they are not accessible from the Internet unless they are designed for such exposure and the intended use requires
such.
- Ensure all nodes are always up to date in terms of installed software, operating system, and
firmware patches as well as anti-virus and firewall.
- When remote access is required, use secure methods, such as Virtual Private Networks (VPNs).
Recognize that VPNs may have vulnerabilities and should be updated to the most current version
available. Also, understand that VPNs are only as secure as the connected devices.

General security recommendations

For additional instructions and support please contact your local ABB service organization. For contact
information, see www.abb.com/contactcenters.

Information about ABB’s cyber security program and capabilities can be found at www.abb.com/cybersecurity.

Support

The information in this document is subject to change without notice, and should not be construed as a
commitment by ABB.

ABB provides no warranty, express or implied, including warranties of merchantability and fitness for a
particular purpose, for the information contained in this document, and assumes no responsibility for
any errors that may appear in this document. In no event shall ABB or any of its suppliers be liable for direct, indirect, special, incidental or consequential damages of any nature or kind arising from the use of
this document, or from the use of any hardware or software described in this document, even if ABB or
its suppliers have been advised of the possibility of such damages.

This document and parts hereof must not be reproduced or copied without written permission from
ABB, and the contents hereof must not be imparted to a third-party nor used for any unauthorized purpose.

All rights to registrations and trademarks reside with their respective owners.

Notice

Mitigating factors describe conditions and circumstances that make an attack that exploits the vulnerability difficult or less likely to succeed.

In case customer cannot opt for not to upgrade the firmware or it is not feasible then please immediately apply mitigating factors mentioned in “General security recommendations”.

Mitigating factors

Summary: Firmware update releases for Lite Panel Pro

Lite Panel Pro Vulnerability in Session Management

Summary: Initial version.

 The Lite Panel Pro web application does not invalidate active user sessions following a password reset. As a result, sessions established prior to the reset may
remain valid, potentially exposing the system to unauthorized access if those
session tokens are compromised. Although the session token is time-limited—
expiring after 15 minutes by default—a malicious actor who obtains a valid token
within this window could potentially have unauthorized access to the system.

CVE description

Summary: NVD -CVE-2025-4407

The vulnerabilities are resolved in the following product versions:
Lite Panel Pro version 1.1.0
ABB advises users to update their devices to the latest firmware version, following the instructions available here: FW updates - Lite Panel Pro | Lite Panel Pro | ABB
Additionally, ABB recommends implementing defensive measures to reduce the risk of vulnerability exploitation, as outlined in the product instruction manual. Please refer to the section “Mitigation factors”
for more information

CVE-2025-4407


ABB became aware of multiple internally discovered vulnerabilities in the WebPro SNMP card PowerValue for the product versions listed as affected in the advisory.

Depending upon the vulnerability, an attacker with access to local network who successfully exploited this vulnerability could have
- Unauthorized access
- Insufficient Session Expiration leading to resource unavailability
- Uncontrolled Resource Consumption leading to DOS attack

ABB strongly advises customers to update the latest firmware of affected products.

Summary

For additional instructions and support please contact your local ABB Digital Service Support ch.ups.digital@abb.com. For contact information, see www.abb.com/contactcenters.

Information about ABB’s cyber security program and capabilities can be found at https://go.abb/cybersecurity.

Support

The information in this document is subject to change without notice, and should not be construed as a commitment by ABB.

ABB provides no warranty, express or implied, including warranties of merchantability and fitness for a particular purpose, for the information contained in this document, and assumes no responsibility for any errors that may appear in this document. In no event shall ABB or any of its suppliers be liable for direct, indirect, special, incidental or consequential damages of any nature or kind arising from the use of this document, or from the use of any hardware or software described in this document, even if ABB or its suppliers have been advised of the possibility of such damages.

This document and parts hereof must not be reproduced or copied without written permission from ABB, and the contents hereof must not be imparted to a third party nor used for any unauthorized purpose.

All rights to registrations and trademarks reside with their respective owners.

Notice

For any installation of software-related ABB products we strongly recommend the following (non-exhaustive) list of cyber security practices:

- Isolate special purpose networks (e.g. for automation systems) and remote devices behind fire-walls and separate them from any general-purpose network (e.g. office or home networks).
- Install physical controls so no unauthorized personnel can access your devices, components, peripheral equipment, and networks.
- Never connect programming software or computers containing programming software to any network other than the network for the devices that it is intended for.
- Scan all data imported into your environment before use to detect potential malware infections.
- Minimize network exposure for all applications and endpoints to ensure that they are not accessible from the Internet unless they are designed for such exposure and the intended use requires such.
- Ensure all nodes are always up to date in terms of installed software, operating system, and firmware patches as well as anti-virus and firewall.
- When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.

General security recommendations

ABB has a rigorous internal cyber security continuous improvement process which involves regular testing with industry leading tools and periodic assessments to identify potential product issues. Occasionally an issue is determined to be a design or coding flaw with implications that may impact product cyber security.

When a potential product vulnerability is identified or reported, ABB immediately initiates our vulnerability handling process. This entails validating if the issue is in fact a product issue, identifying root causes, determining what related products may be impacted, developing a remediation, and notifying end users and governmental organizations.

The resulting Cyber Security Advisory intends to notify customers of the vulnerability and provide de-tails on which products are impacted, how to mitigate the vulnerability or explain workarounds that minimize the potential risk as much as possible. The release of a Cyber Security Advisory should not be misconstrued as an affirmation or indication of an active threat or ongoing campaign targeting the products mentioned here. If ABB is aware of any specific threats, it will be clearly mentioned in the communication.

The publication of this Cyber Security Advisory is an example of ABB’s commitment to the user community in support of this critical topic. Responsible disclosure is an important element in the chain of trust we work to maintain with our many customers. The release of an Advisory provides timely information which is essential to help ensure our customers are fully informed.

Purpose

What causes the vulnerability?

- The vulnerabilities are caused by code defects allowing the attacker to do various unintended, unauthorized actions on the target device. Please look at the description of the respective vulnerabilities in section “Vulnerability severity and details” for further details.

What is WebPro SNMP Card PowerValue?

- The WebPro SNMP Card PowerValue provide web server to monitor and manage multiple UPS products in networked environment. It can detect temperature and humidity for the environment via connecting to EMD (Environmental Monitoring Device). It can not only prevent data loss from power outage and safely shutdown systems but also store programming data and scheduled shut down the UPS. All UPS warning and fault event records can be kept in WebPro SNMP Card PowerValue.

What might an attacker use the vulnerability to do?

- If mentioned vulnerabilities have been successfully exploited by an attacker, this could allow the attacker to take control of the target WebPro SNMP Card PowerValue device.

How could an attacker exploit the vulnerability?

- An attacker could try to exploit the vulnerability by creating a specially crafted message and sending the message to WebPro SNMP Card PowerValue device. This would require that the attacker has access to the system network, by connecting to the network either directly or through a wrongly configured or penetrated security system.

Could the vulnerability be exploited remotely?

- Yes, an attacker who has network access to an affected system node could exploit this vulnerability. Recommended practices include that User’s network systems are physically protected, have no direct connections to the Internet nor any other untrusted network, and are separated from other networks by means of a firewall system that has a minimal number of ports exposed.

What does the update do?

- WebPro SNMP Card PowerValue v1.1.8.p update has fixes for all the vulnerabilities mentioned in “Vulnerability severity and details” section.

When this security advisory was issued, had this vulnerability been publicly disclosed?

- No, the vulnerabilities have not been publicly disclosed.

When this security advisory was issued, had ABB received any reports that this vulnerability was being exploited?

- No, ABB had not received any information indicating that this vulnerability had been exploited when this security advisory was originally issued.

Frequently Asked Questions

Summary: ABB CYBERSECURITY ADVISORY - PDF Version

Summary: ABB CYBERSECURITY ADVISORY - CSAF Version

WebPro SNMP Card PowerValue Multiple Vulnerabilities

Summary: Initial version.

ABB

WebPro SNMP Card

PowerValue

ABB WebPro SNMP Card PowerValue <=1.1.8.k

PowerValue UL

ABB WebPro SNMP Card PowerValue UL <=1.1.8.k

ABB WebPro SNMP Card PowerValue UL 1.1.8.p

Improper Check for Unusual or Exceptional Conditions

Modus(slave) protocol was implemented incorrectly in the device, port 502 becomes unstable and Modbus service is unavailable until manual reboot of the device.

CVE description

Summary: NVD - CVE-2025-4675

The problem is corrected in the following product versions:

WebPro SNMP card PowerValue version 1.1.8.p

ABB advises users of the affected product versions to reach out to ABB Digital Service Support (ch.ups.digital@abb.com) for guidance and recommended actions.

Additionally, ABB recommends implementing defensive measures to reduce the risk of vulnerability exploitation, as outlined in the product instruction manual. Please refer to the section “Mitigation factors” for more information.

Mitigating factors describe conditions and circumstances that make an attack that exploits the vulnerability difficult or less likely to succeed.

In case customer cannot opt for not to upgrade the firmware or it is not feasible then please immediately apply mitigating factors mentioned in “General security recommendations”.

CVE-2025-4675

Incorrect Implementation of Authentication Algorithm

Device web HMI authenticates user by validating the first character of the session cookie and authentication token. So, if only the first characters of the session cookie and token are correct, a user will be validated. An attacker can easily brute force the first character of both session cookie and bearer token. This vulnerability allows an attacker to easily bypass the authentication implemented on the device.

CVE description

Summary: NVD - CVE-2025-4676

CVE-2025-4676

Idle session timeout is not configured for port 23 and 502 in device, due to which an attacker can make number of connections to the device and since device is not destroying the connections, it can lead to unavailability of the resources from the device.

CVE description

Summary: NVD - CVE-2025-4677

CVE-2025-4677


ABB is aware of public reports of the vulnerabilities in the product versions listed as affected in this advisory.
An attacker who successfully exploited modem module vulnerabilities could run arbitrary code in the wireless modem module of the product. This could lead to denial of service or tampering with unencrypted traffic.
An attacker who successfully exploited the OpenSSH vulnerability could run arbitrary code in the product with privileged user permissions. This could cause the product to stop, make the product inaccessible, or the attacker could take control of the product.
As part of ABB product lifecycle policy, once a product transitions to Limited state, we discontinue maintenance, security patches, and technical support to focus on current and future technologies. While the product will continue to function, we strongly recommend implementing mitigations defined in this document to mitigate security risks.

Summary

For additional instructions and support please contact your local ABB service organization. For contact information, see www.abb.com/contactcenters.
Information about ABB’s cyber security program and capabilities can be found at www.abb.com/cybersecurity.

Support

For any installation of software-related ABB products we strongly recommend the following (non-exhaustive) list of cyber security practices:
–	Isolate special purpose networks (e.g., for automation systems) and remote devices behind fire-walls and separate them from any general-purpose network (e.g., office or home networks).
–	Install physical controls so no unauthorized personnel can access your devices, components, peripheral equipment, and networks.
–	Never connect programming software or computers containing programing software to any network other than the network for the devices that it is intended for.
–	Scan all data imported into your environment before use to detect potential malware infections.
–	Minimize network exposure for all applications and endpoints to ensure that they are not accessible from the Internet unless they are designed for such exposure and the intended use requires such.
–	Ensure all nodes are always up to date in terms of installed software, operating system, and firmware patches as well as anti-virus and firewall.
–	When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.

General security recommendations

The information in this document is subject to change without notice, and should not be construed as a commitment by ABB.
ABB provides no warranty, express or implied, including warranties of merchantability and fitness for a particular purpose, for the information contained in this document, and assumes no responsibility for any errors that may appear in this document. In no event shall ABB or any of its suppliers be liable for direct, indirect, special, incidental or consequential damages of any nature or kind arising from the use of this document, or from the use of any hardware or software described in this document, even if ABB or its suppliers have been advised of the possibility of such damages.
This document and parts hereof must not be reproduced or copied without written permission from ABB, and the contents hereof must not be imparted to a third party nor used for any unauthorized purpose.
All rights to registrations and trademarks reside with their respective owners.

Notice

The following mitigations can be considered
•	Obtain a private cellular access point to limit impact of any potential exploit. Contact your cellular provider for availability.
•	Mitigate the cellular module vulnerabilities by contacting the mobile network operator and requesting to disable binary SMS for your mobile subscription.
o	Note that binary SMS service is often disabled by default based on operator restrictions.
o	If SMS services are not used in the solution, consider disabling them completely.
•	Establish remote connections through OpenVPN. If the SSH protocol is used for remote administration of Arctic wireless gateway, it is to be considered logging in to the wireless gateway through an OpenVPN tunnel.
•	Do not expose SSH port to public networks. Keep the SSH port closed to public networks and thus limit the number of potential attackers who can attempt to exploit the vulnerability. This way only devices within your private network or those connected through a secure VPN can access the SSH server.

•	Restrict physical access to the product.

Refer to section General security recommendations for further advice on how to keep your system secure.

Mitigating factors

Summary: Summary: ABB product lifecycle policy

Summary: 1MRS758860, Rev. F Arctic, Cyber Security Deployment Guideline

ABB Arctic ARG600, ARC600, ARR600, ARP600 Arctic Wireless Gateway Modem Module and OpenSSH vulnerabilities

Summary: Initial Version

ABB

Arctic Wireless Gateways

Arctic Wireless Gateway ARG600 with Telit PLS62-W wireless modem module.

Arctic Wireless Gateway ARC600 with Telit PLS62-W wireless modem module.

Arctic Wireless Gateway ARR600 with Telit PLS62-W wireless modem module.

Arctic

Arctic ARG600 with firmware version>=3.4.10  to <=3.4.13

Arctic ARC600 with firmware version>=3.4.10  to <=3.4.13

Arctic ARR600 with firmware version>=3.4.10  to <=3.4.13

Arctic ARP600 with firmware version>=3.4.10  to <=3.4.13

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

A buffer overflow vulnerability that could allow a remote unauthenticated attacker to execute arbitrary code on the targeted system by sending a specially crafted Short Message Service (SMS) message.

CVE Description

Summary: NVD - CVE-2023-47610

CVE-2023-47610

Improper Privilege Management vulnerability that could allow a local that could allow a local, low privileged attacker to elevate privileges to "manufacturer" level on the targeted system by sending a specially crafted SMS message.

CVE Description

Summary: NVD - CVE-2023-47611

CVE-2023-47611

Exposure of Sensitive Information to an Unauthorized Actor

Files or Directories Accessible to External Parties vulnerability that could allow an attacker with physical access to the target system to obtain a read/write access to any files and directories on the wireless modem module, including hidden files and directories.

CVE Description

Summary: NVD - CVE-2023-47612

CVE-2023-47612

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Relative Path Traversal vulnerability that could allow a local, low privileged attacker to escape from virtual directories and get read/write access to protected files on the wireless modem module.

CVE Description

Summary: NVD - CVE-2023-47613

CVE-2023-47613

Exposure of Sensitive Information to an unauthorized actor vulnerability that could allow a local, low privileged attacker to disclose hidden virtual paths and file names on the wireless modem module.

CVE Description

Summary: NVD - CVE-2023-47614

CVE-2023-47614

Exposure of Sensitive Information Through Environmental Variables vulnerability that could allow a local, low privileged attacker to get access to sensitive data on the wireless modem module.

CVE Description

Summary: NVD - CVE-2023-47615

CVE-2023-47615

Exposure of Sensitive Information to an unauthorized actor vulnerability that could allow an attacker with physical access to the target system to get access to sensitive data on the wireless modem mod-ule.

CVE Description

Summary: NVD- CVE-2023-47616

CVE-2023-47616

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

The vulnerability is a signal handler race condition in OpenSSH’s server (sshd) on glibc-based Linux systems, allowing unauthenticated remote code execution (RCE) as root.

CVE Description

Summary: NVD - CVE-2024-6387

CVE-2024-6387


ABB is aware of public reports of a vulnerabilities in product versions listed as affected in this advisory. An attacker who successfully exploited these vulnerabilities could cause the product to stop, make the product inacces-sible, take remote control of the product or insert and run arbitrary code.
As part of ABB product lifecycle policy, once a product transitions to end-of-life, we discontinue maintenance, security patches, and technical support to focus on current and future technologies. While the product will continue to function, we strongly recommend implementing mitigations defined in this document, such as using a private APN cellular network between Arctic wireless gateways and ARM600 for establishing VPN tunnels, to mitigate security risks and avoid potential vulnerabilities.
As part of ABB product lifecycle policy, once a product transitions to Limited state, we discontinue maintenance, security patches, and technical support to focus on current and future technologies. While the product will continue to function, we strongly recommend implementing mitigations defined in this document to mitigate security risks.

Summary

Mitigating factors describe conditions and circumstances that make an attack that exploits the vulnerability difficult or less likely to succeed. The following mitigations are recommended.
1.	Obtain a cellular private access point (APN). A dedicated private cellular access point and respective SIM card subscriptions can be requested from your cellular service provider. This service doesn’t expose the traffic between remote sites and main site to the internet but rather uses cellular operator’s private wide area network (WAN). Therefore, the ARM600 wouldn’t need open ports to the internet.
2.	Avoid exposing any system component to the internet. If, however, the ARM600 is exposed to the internet, only the VPN port should be opened towards the internet (e.g., Patrol management connections can be configured to use VPN tunnel and remote administration connections can be implemented by using OpenVPN PC-client).
3.	ARM600 system is by default not dependent on the name service (DNS). If name service is not used in the system, the name service port (TCP/UDP port 53) can be blocked by a firewall.
4.	Perform firewall configuration by the "allowlisting" principle, i.e., explicitly allowing only the required ports and protocols and blocking any other traffic.
5.	Filter specific ICMP packets from external systems (ICMP type 13 and 14) by firewall for not exposing the system time.
6.	If the internet is used as a WAN media for carrying VPN tunnels, use Demilitarized Zone (DMZ) for terminating connections from the internet (i.e., the remote connections should terminate to the DMZ network, which would be segregated from other networks by a firewall. The ARM600 server would be located into this DMZ).

7.	Change the default user credentials of ARM600 and Arctic wireless gateways into non-defaults and use complex non-guessable passwords with special characters. Do not reuse passwords within the system.

8.	Use administrator (i.e., root user) privileges only when required by the task.

9.	Supporting systems, such as PCs used for configuration, should be frequently updated. If possible, use dedicated site PCs for upgrading and engineering purposes. At minimum, PCs should be investigated by running a full virus scan with recently updated signature files before introducing the PC to the OT system.

Any data, such as device configurations and firmware update files transferred to the Arctic system should be virus scanned prior to transferring.

10.	Introduce a backup policy, which will ensure periodical backups and backup revision numbering. Consider the following:
a.	Check that the entire system has backups available from all applicable parts.
b.	Store the backups in a safe place (e.g. in an encrypted storage), restricted by role-based access control mechanisms.
c.	Ensure the security of the configuration PCs that may have local copies of device configurations.
d.	Validate the backups to make sure that they’re working.

11.	Follow cyber security best practices for installation, operation, and decommissioning as described in the product’s Cyber Security Deployment Guideline and User Manual.

12.	Use continuous monitoring (e.g., intrusion detection/prevention tools) to detect anomalies in the system

13.	Consider hardening the system according to the following:
a.	Remove any unnecessary communication links in the system.
b.	If possible, close unused physical ports.
c.	Open only the necessary TCP/UDP ports in the configuration.
d.	Remove all unnecessary user accounts.
e.	Restrict traffic by firewall.
f.	Allow the traffic only from/to necessary hosts' IP addresses (i.e., define both source and destination in the firewall rules, where possible).
g.	Define client IP address as allowed address in SCADA communication protocols, if such configuration is supported.
h.	Remove or deactivate all unused processes, communication ports and services, where possible.
i.	Use physical access controls to the system installations (e.g., to server rooms and device cabinets).

14.	In ARM600SW installations, avoid servers with AMD processors vulnerable to the following: CVE-2021-26401, CVE-2023-20569 and CVE-2023-20593.

15.	Avoid using AX88179_178A chipset-based USB -to-Ethernet devices.

Refer to section General security recommendations for additional advice on how to keep your system secure.

Mitigating factors

For any installation of software-related ABB products we strongly recommend the following (non-exhaustive) list of cyber security practices:
–	Isolate special purpose networks (e.g. for automation systems) and remote devices behind firewalls and separate them from any general-purpose network (e.g. office or home networks).
–	Install physical controls so no unauthorized personnel can access your devices, components, peripheral equipment, and networks.
–	Never connect programming software or computers containing programing software to any network other than the network for the devices that it is intended for.
–	Scan all data imported into your environment before use to detect potential malware infections.
–	Minimize network exposure for all applications and endpoints to ensure that they are not accessible from the internet unless they are designed for such exposure and the intended use requires such.
–	Ensure all nodes are always up to date in terms of installed software, operating system, and firmware patches as well as anti-virus and firewall.
–	When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.
More information on recommended practices can be found in the following document:
1MRS758860 Rev. F, Arctic Cyber Security Deployment Guideline

General security recommendations

Support

Notice

Summary: Cyber Security Deployment Guideline

Summary: User Manual

Summary: ABB product lifecycle policy

ABB Arctic communication solution ARM600 Vulnerabilities

Summary: Initial Version

ABB

ABB M2M Gateway

ABB M2M Gateway ARM600, firmware versions >=4.1.2|<=5.0.3

SW

ABB M2M Gateway SW, software versions >=5.0.1|<=5.0.3

Vulnerability in Git that arises from an issue with git attributes parsing. This flaw can lead to an integer overflow, which might be exploited by authenticated attackers to execute arbitrary code or cause a denial of service.

CVE description

Summary: NVD - CVE-2022-23521

Mitigating factors describe conditions and circumstances that make an attack that exploits the vulnerability difficult or less likely to succeed. The following mitigations are recommended.

1.	Obtain a cellular private access point (APN). A dedicated private cellular access point and respective SIM card subscriptions can be requested from your cellular service provider. This service doesn’t expose the traffic between remote sites and main site to the internet but rather uses cellular operator’s private wide area network (WAN). Therefore, the ARM600 wouldn’t need open ports to the internet.

2.	Avoid exposing any system component to the internet. If, however, the ARM600 is exposed to the internet, only the VPN port should be opened towards the internet (e.g., Patrol management connections can be configured to use VPN tunnel and remote administration connections can be implemented by using OpenVPN PC-client).

4.	Perform firewall configuration by the "allowlisting" principle, i.e., explicitly allowing only the required ports and protocols and blocking any other traffic.

6.	If the internet is used as a WAN media for carrying VPN tunnels, use Demilitarized Zone (DMZ) for terminating connections from the internet (i.e., the remote connections should terminate to the DMZ network, which would be segregated from other networks by a firewall. The ARM600 server would be located into this DMZ).

7.	Change the default user credentials of ARM600 and Arctic wireless gateways into non-defaults and use complex non-guessable passwords with special characters. Do not reuse passwords within the system.

8.	Use administrator (i.e., root user) privileges only when required by the task.

9.	Supporting systems, such as PCs used for configuration, should be frequently updated. If possible, use dedicated site PCs for upgrading and engineering purposes. At minimum, PCs should be investigated by running a full virus scan with recently updated signature files before introducing the PC to the OT system.

Any data, such as device configurations and firmware update files transferred to the Arctic system should be virus scanned prior to transferring.

10.	Introduce a backup policy, which will ensure periodical backups and backup revision numbering. Consider the following:
a.	Check that the entire system has backups available from all applicable parts.
b.	Store the backups in a safe place (e.g. in an encrypted storage), restricted by role-based access control mechanisms.
c.	Ensure the security of the configuration PCs that may have local copies of device configurations.
d.	Validate the backups to make sure that they’re working.

11.	Follow cyber security best practices for installation, operation, and decommissioning as described in the product’s Cyber Security Deployment Guideline and User Manual.

12.	Use continuous monitoring (e.g., intrusion detection/prevention tools) to detect anomalies in the system

13.	Consider hardening the system according to the following:
a.	Remove any unnecessary communication links in the system.
b.	If possible, close unused physical ports.
c.	Open only the necessary TCP/UDP ports in the configuration.
d.	Remove all unnecessary user accounts.
e.	Restrict traffic by firewall.
f.	Allow the traffic only from/to necessary hosts' IP addresses (i.e., define both source and destination in the firewall rules, where possible).
g.	Define client IP address as allowed address in SCADA communication protocols, if such configuration is supported.
h.	Remove or deactivate all unused processes, communication ports and services, where possible.
i.	Use physical access controls to the system installations (e.g., to server rooms and device cabinets).

CVE-2022-23521

Vulnerability in Git that involves a heap overflow in the git archive and git log --format commands. This flaw can potentially lead to remote code execution (RCE) if exploited by authenticated attacker.

CVE Description

Summary: NVD - CVE-2022-41903

CVE-2022-41903

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

Vulnerability in Apache HTTP Server versions 2.4.0 through 2.4.55. It involves HTTP Request Smuggling
due to certain mod_proxy configurations combined with RewriteRule or ProxyPassMatch directives. This
flaw can lead to bypassing access controls by an authenticated attacker.

CVE Description

Summary: NVD - CVE-2023-25690

CVE-2023-25690

Vulnerability in the PKCS#11 feature of ssh-agent in OpenSSH versions before 9.3p2. It involves an
insufficiently trustworthy search path, which can lead to remote code execution if an agent is
forwarded by authenticated user to an attacker-controlled system.

CVE Description

Summary: NVD -CVE-2023-38408

CVE-2023-38408

Untrusted search path vulnerability in ssh-agent.c in ssh-agent in OpenSSH before 7.4 allows remote
attackers to execute arbitrary local PKCS#11 modules by leveraging control over a forwarded agent socket.

CVE Description

Summary: NVD - CVE-2016-10009

CVE-2016-10009

A use-after-free vulnerability was found in system. This issue occurs due to the on_stream_io() function and dns_stream_complete() function in 'resolved-dns-stream.c' not incrementing the reference counting for the DnsStream object. Therefore, other functions and callbacks called can dereference the DNSStream object, causing the use-after-free when the reference is still used later, allowing authenticated user to execute arbitrary code.

CVE Description

Summary: NVD - CVE-2022-2526

CVE-2022-2526

zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field, potentially allowing an authenticated attacker to reveal sensitive information or to cause a denial-of-service situation.

CVE Description

Summary: NVD - CVE-2022-37434

CVE-2022-37434

A vulnerability in the HFS+ partition file parser of ClamAV versions 1.0.0 and earlier, 0.105.1 and earlier, and 0.103.7 and earlier could allow an unauthenticated, remote attacker to execute arbitrary code. This vulnerability is due to a missing buffer size check that may result in a heap buffer overflow write. An authenticated attacker could exploit this vulnerability by submitting a crafted HFS+ partition file to be scanned by ClamAV on an affected device.

CVE Description

Summary: NVD - CVE-2023-20032

CVE-2023-20032

Missing Release of Memory after Effective Lifetime

By spoofing the target resolver with responses that have a malformed ECDSA signature, an attacker can trigger a small memory leak. It is possible to gradually erode available memory to the point where named crashes for lack of resources.

CVE Description

Summary: NVD- CVE-2022-38177

Mitigating factors describe conditions and circumstances that make an attack that exploits the vulnerability difficult or less likely to succeed. The following mitigations are recommended.

3.	ARM600 system is by default not dependent on the name service (DNS). If name service is not used in the system, the name service port (TCP/UDP port 53) can be blocked by a firewall.

Refer to section General security recommendations for additional advice on how to keep your system secure.

CVE-2022-38177

By spoofing the target resolver with responses that have a malformed EdDSA signature, an attacker can trigger a small memory leak. It is possible to gradually erode available memory to the point where named crashes for lack of resources.

CVE Description

Summary: NVD -CVE-2022-38178

CVE-2022-38178

Allocation of Resources Without Limits or Throttling

The vulnerability allows the configured max-cache-size limit to be significantly exceeded by querying the resolver for specific RRsets in a certain order. This can lead to a denial-of-service condition by ex-hausting all available memory on the host running named service.

CVE Description

Summary: NVD- CVE-2023-2828

CVE-2023-2828

The vulnerability involves the recursive processing of control channel messages sent to named, which can exhaust stack memory and cause named to terminate unexpectedly. Exploiting this flaw requires only network access to the control channel's configured TCP port, without needing a valid RNDC key.

CVE Description

Summary: NVD - CVE-2023-3341

CVE-2023-3341

Local users able to write to UNIX domain sockets can bypass access controls and manipulate the mul-tipath setup. This can lead to local privilege escalation to root. This occurs because an attacker can repeat a keyword, which is mishandled because arithmetic ADD is used instead of bitwise OR.

CVE Description

Summary: NVD -CVE-2022-41974

CVE-2022-41974

Local users can write to UNIX domain sockets can bypass access controls and manipulate the multipath setup. This can lead to local privilege escalation to root. This occurs because an attacker can repeat a keyword, which is mishandled because arithmetic ADD is used instead of bitwise OR.

CVE Description

Summary: NVD - CVE-2022-40674

CVE-2022-40674

By feeding specially crafted input as authenticated attacker to `git apply --reject`, a path outside the working tree can be overwritten with partially controlled contents, leading to potential arbitrary code execution.

CVE Description

Summary: NVD- CVE-2023-25652

CVE-2023-25652

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

A specially crafted `.gitmodules` file with submodule URLs that are longer than 1024 characters can used to exploit a bug in `config.c::git_config_copy_or_rename_section_in_file()`. This bug can be used to inject arbitrary configuration into a user's `$GIT_DIR/config` when attempting to remove the con-figuration section associated with that submodule. When the attacker injects configuration values which specify executables to run (such as `core.pager`, `core.editor`, `core.sshCommand`, etc.) this can lead to a remote code execution.

CVE Decsription

Summary: NVD- CVE-2023-29007

CVE-2023-29007

Improper Restriction of Operations within the Bounds of a Memory Buffer

A flaw was found in the Linux kernel’s driver for the ASIX AX88179_178A-based USB 2.0/3.0 Gigabit Ethernet Devices. The vulnerability contains multiple out-of-bounds reads and possible out-of-bounds writes.

CVE Description

Summary: NVD - CVE-2022-2964

Mitigating factors describe conditions and circumstances that make an attack that exploits the vulnerability difficult or less likely to succeed. The following mitigations are recommended.

15.	Avoid using AX88179_178A chipset-based USB -to-Ethernet devices.

Refer to section General security recommendations for additional advice on how to keep your system secure.

CVE-2022-2964

Flaw in certain AMD EPYC, Ryzen, Threadripper and Athlon processors considering LONGJMP assembly command. This could lead to arbitrary code execution. Note: ARM600 servers include Intel processors, but there may be ARM600 SW installations running in AMD processor environments.

CVE Description

Summary: NVD - CVE-2021-26401

Mitigating factors describe conditions and circumstances that make an attack that exploits the vulnerability difficult or less likely to succeed. The following mitigations are recommended.

14.	In ARM600SW installations, avoid servers with AMD processors vulnerable to the following: CVE-2021-26401, CVE-2023-20569 and CVE-2023-20593.

Refer to section General security recommendations for additional advice on how to keep your system secure.

CVE-2021-26401

A stack overflow flaw was found in the Linux kernel's SYSCTL subsystem in how an authenticated user changes certain kernel parameters and variables. This flaw allows a local user to crash or potentially escalate their privileges on the system.

CVE Description

Summary: NVD- CVE-2022-4378

CVE-2022-4378

mm/rmap.c in the Linux kernel before 5.19.7 has a use-after-free related to leaf anon_vma double re-use. This could lead to a system crash or elevation of privileges.

CVE Description

Summary: NVD - CVE-2022-42703

CVE-2022-42703

A vulnerability classified as critical was found in Linux Kernel. Affected by this vulnerability is the function l2cap_reassemble_sdu of the file net/bluetooth/l2cap_core.c of the component Bluetooth. The manipulation leads to use after free. This could cause leaking of data or Denial of Service (DoS) conditions.

CVE Description

Summary: NVD - cve-2022-3564

CVE-2022-3564

In the Linux kernel through 6.3.1, a use-after-free in Netfilter nf_tables when processing batch requests can be abused to perform arbitrary read and write operations on kernel memory. This could lead to an unprivileged local user gaining root access.

CVE Description

Summary: NVD - CVE-2023-32233

CVE-2023-32233

Kernel nftables Out-Of-Bounds Read/Write Vulnerability; nft_byteorder poorly handled vm register contents when CAP_NET_ADMIN is in any user or network namespace. This vulnerability could lead to local user privilege escalation.

CVE Description

Summary: NVD - CVE-2023-35001

CVE-2023-35001

A use-after-free vulnerability in the Linux kernel's net/sched: cls_u32 component can be exploited to achieve local user privilege escalation.

CVE Description

Summary: NVD - CVE-2023-3609

CVE-2023-3609

A missing netfilter macro could lead to a miscalculation of the `h->nets` array offset, providing attack-ers with the primitive to arbitrarily increment/decrement a memory buffer out-of-bounds. This vulnerability may allow a local user to crash the system or potentially escalate their privileges.

CVE Description

Summary: NVD - CVE-2023-42753

CVE-2023-42753

PAC parsing in krb5 has integer overflows that may lead to denial of service.

CVE Description

Summary: NVD - cve-2022-42898

CVE-2022-42898

An issue was discovered in function _libssh2_packet_add in libssh2 that allows attackers to access out of bounds memory. This could lead to a system crash by authenticated attacker.

CVE Description

Summary: NVD- CVE-2020-22218

CVE-2020-22218

Access of Resource Using Incompatible Type ('Type Confusion')

X.400 addresses were parsed as an ASN1_STRING but the public structure definition for GENERAL_NAME incorrectly specified the type of the x400Address field as ASN1_TYPE.  When CRL checking is enabled, this vulnerability may allow an attacker to pass arbitrary pointers to a memcmp call, enabling them to read memory contents or enact a denial of service.

CVE Description

Summary: NVD- CVE-2023-0286

CVE-2023-0286

An issue in the urllib.parse component of Python allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters. Successful exploitation of this vulnerability could lead to addition or modification of data by an authenticated attacker.

CVE Description

Summary: NVD - CVE-2023-24329

CVE-2023-24329

Remote arbitrary files write inside the directories of connecting peers. A malicious rsync server can overwrite arbitrary files in the rsync client target directory and subdirectories.

CVE Description

Summary: NVD- CVE-2022-29154

CVE-2022-29154

The sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environment variables (SUDO_EDITOR, VISUAL, and EDITOR), allowing a local attacker to append arbitrary entries to the list of files to process. This could lead to privilege escalation.

CVE Description

Summary: NVD - CVE-2023-22809

CVE-2023-22809

Apache portable runtime utility issue may allow a malicious attacker to cause an out-of-bounds write due to an integer overflow when encoding/decoding a very long string using the base64 family of functions. This could lead to modification of data or denial of service.

CVE Description

Summary: NVD - CVE-2022-25147

CVE-2022-25147

When using forwarders, bogus NS records supplied by, or via, those forwarders may be cached and used by named if it needs to recurse for any reason, causing it to obtain and pass on potentially incor-rect answers. This could cause DNS cache poisoning that could potentially lead to a denial of service and information disclosure by an authenticated attacker.

CVE Description

Summary: NVD- CVE-2021-25220

CVE-2021-25220

Processing large delegations may severely degrade resolver performance effectively denying legitimate clients access to the DNS resolution service. This could cause a denial-of-service conditions.

CVE Descritpion

Summary: NVD - CVE-2022-2795

CVE-2022-2795

drivers/usb/mon/mon_bin.c in usbmon in the Linux kernel allows a user-space client to corrupt the monitor's internal memory. This could lead to denial-of-service or information disclosure conditions by an authenticated attacker.

CVE Description

Summary: NVD- CVE-2022-43750

CVE-2022-43750

Return Address Predictor vulnerability leading to information disclosure in certain AMD processors. This may result in speculative execution at an attacker-controlled address, potentially leading to information disclosure. Note: ARM600 servers utilize Intel processors, but there may be ARM600 SW installations running in AMD processor environments.

CVE Description

Summary: NVD- CVE-2023-20569

CVE-2023-20569

Generation of Error Message Containing Sensitive Information

Cross-Process Information Leak in certain AMD processors. This could lead to an attacker potentially accessing confidential information. Note: ARM600 servers utilize Intel processors, but there may be ARM600 SW installations running in AMD processor environments.

CVE Description

Summary: NVD - CVE-2023-20593

CVE-2023-20593

If a TLS server side socket is created, receives data, and then closes quickly, there's a brief window where the SSLSocket instance detects it as "not connected" and won't initiate a handshake. Buffered data remains readable but unauthenticated if client certificate authentication is expected. This data is limited to the buffer size. An unauthenticated attacker could exploit this vulnerability for revealing sensitive information from the server.

CVE Description

Summary: NVD- CVE-2023-40217

CVE-2023-40217

Improper Validation of Integrity Check Value

Remote attackers may bypass integrity checks such that some packets are omitted (from the extension negotiation message), and a client and server may consequently end up with a connection for which some security features have been downgraded or disabled, aka a Terrapin attack.

CVE Description

Summary: NVD- CVE-2023-48795

CVE-2023-48795

TLS protocol version 1.1 and 1.2 and the DTLS protocol 1.0 and 1.2 do not properly consider timing side-channel attacks on a MAC check requirement during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, aka the "Lucky Thirteen" issue.

CVE Description

Summary: NVD- CVE-2013-0169

CVE-2013-0169

Improper Removal of Sensitive Information Before Storage or Transfer

The TLS protocol 1.2 and earlier can encrypt compressed data without properly obfuscating the length of the unencrypted data, which allows man-in-the-middle attackers to obtain plaintext HTTP headers by observing length differences during a series of guesses in which a string in an HTTP request potentially matches an unknown string in an HTTP header, aka a "CRIME" attack.

CVE Description

CVE-2012-4929

The “ICMP Timestamp Request Remote Date Disclosure” vulnerability involves the use of ICMP (internet Control Message Protocol) to request and receive timestamp information from a target system.

CVE Description

Summary: NVD - CVE-1999-0524

Mitigating factors describe conditions and circumstances that make an attack that exploits the vulnerability difficult or less likely to succeed. The following mitigations are recommended.

5.	Filter specific ICMP packets from external systems (ICMP type 13 and 14) by firewall for not exposing the system time.

Refer to section General security recommendations for additional advice on how to keep your system secure.

CVE-1999-0524


ABB is aware of vulnerabilities in the product versions listed as affected in the advisory.
The vulnerability enables unauthorized access to the Reboot OS function within the Remote Transport Service, allowing an attacker to trigger a system reboot without the required authentication. This functionality initiates a system reboot on the target machine. However, remote exploitation of this vulnerability is not feasible unless the attacker has already gained access to the network where the affected ABB Ability™ zenon system is deployed.
At the time of writing, there is no evidence that this vulnerability is being actively exploited in the wild.

summary

•ABB recommends installing only the Service Engine component on production systems and installing the Engineering Studio on a separate dedicated Engineering station. Physical, local access to systems with the ABB AbilityTM zenon Software Platform should be restricted to authorized users only in an environment with physical access control measures in place.
•ABB recommends that system integrators and asset owners conduct their own risk assessments to determine appropriate mitigation strategies.
•ABB recommends keeping the operating system and software up to date

General security recommendations

For additional instructions and support please contact your local ABB service organization.
For contact
information, see www.abb.com/contactcenters.

Information about ABB’s cyber security program and capabilities can be found at www.abb.com/cybersecurity.

support

The information in this document is subject to change without notice, and should not be construed as a commitment by ABB.

ABB provides no warranty, express or implied, including warranties of merchantability and fitness for a particular purpose, for the information contained in this document, and assumes no responsibility for any errors that may appear in this document. In no event shall ABB or any of its suppliers be liable for direct, indirect, special, incidental or consequential damages of any nature or kind arising from the use of this document, or from the use of any hard-ware or software described in this document, even if ABB or its suppliers have been advised of the possibility of such damages.

This document and parts hereof must not be reproduced or copied without written permission from ABB, and the contents hereof must not be imparted to a third party nor used for any unauthorized purpose.

All rights to registrations and trademarks reside with their respective owners.

Notice

•	Restrict network access to systems with the ABB zenon Software Platform installed.

-	Ensure that access to a system is restricted by implementing access controls to minimize the risk of unauthorized access.

•	Assess the necessity of the ABB zenon Remote Transport functionality.

-	Ensure that if the Remote Transport functionality is not used, the zensyssrv.exe (ABB zenon System Service) is stopped or terminated. The zensyssrv.exe can also be stopped or terminated after authorized use to prevent this vulnerability.

Work around

ABB AbilityTM zenon Remote Transport Vulnerability

Summary: Initial version.

Missing Authentication for Critical Function

In the default configuration of the ABB zenon software platform, the zensyssrv.exe service is set to start automatically. To utilize the Remote Transport Service, users are required to configure a password beforehand. However, a security vulnerability has been identified that enables unauthorized attackers to bypass authentication mechanisms and remotely initiate a system reboot without proper authorization

CVE description

Summary: NVD -CVE-2025-8754

CVE-2025-8754


© Copyright 2025 ABB. All rights reserved.

An update is available that resolves vulnerability in the product versions listed as affected in this advisory.

An attacker who successfully exploited this vulnerability could insert and run arbitrary code in the system.

Summary

For any installation of software-related ABB products we strongly recommend the following (non-exhaustive) list of cyber security practices:

– Isolate special purpose networks (e.g., for automation systems) and remote devices behind firewalls and separate them from any general-purpose network (e.g., office or home networks).

– Install physical controls so no unauthorized personnel can access your devices, components, peripheral equipment, and networks.

– Never connect programming software or computers containing programing software to any network other than the network for the devices that it is intended for.

– Scan all data imported into your environment before use to detect potential malware infections.

– Minimize network exposure for all applications and endpoints to ensure that they are not accessible from the Internet unless they are designed for such exposure and the intended use requires such.

– Ensure all nodes are always up to date in terms of installed software, operating system, and firmware patches as well as anti-virus and firewall.

– When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.

General security recommendations

For additional instructions and support please contact your local ABB service organization. For contact information, see www.abb.com/contactcenters.

Information about ABB’s cyber security program and capabilities can be found at www.abb.com/cybersecurity.

Support

The information in this document is subject to change without notice, and should not be construed as a commitment by ABB.

ABB provides no warranty, express or implied, including warranties of merchantability and fitness for a particular purpose, for the information contained in this document, and assumes no responsibility for any errors that may appear in this document. In no event shall ABB or any of its suppliers be liable for direct, indirect, special, incidental or consequential damages of any nature or kind arising from the use of this document, or from the use of any hardware or software described in this document, even if ABB or its suppliers have been advised of the possibility of such damages.

This document and parts hereof must not be reproduced or copied without written permission from ABB, and the contents hereof must not be imparted to a third party nor used for any unauthorized purpose.

All rights to registrations and trademarks reside with their respective owners.

Notice

Mitigating factors describe conditions and circumstances that make an attack that exploits vulnerability difficult or less likely to succeed.

Refer to section “General security recommendations” for further advise on how to keep your system secure.

Mitigating factors

ABB has a rigorous internal cyber security continuous improvement process which involves regular testing with industry leading tools and periodic assessments to identify potential product issues. Occasionally an issue is determined to be a design or coding flaw with implications that may impact product cyber security.

When a potential product vulnerability is identified or reported, ABB immediately initiates our vulnerability handling process. This entails validating if the issue is in fact a product issue, identifying root causes, determining what related products may be impacted, developing a remediation, and notifying end users and governmental organizations.

The resulting Cyber Security Advisory intends to notify customers of the vulnerability and provide details on which products are impacted, how to mitigate the vulnerability or explain workarounds that minimize the potential risk as much as possible. The release of a Cyber Security Advisory should not be misconstrued as an affirmation or indication of an active threat or ongoing campaign targeting the products mentioned here. If ABB is aware of any specific threats, it will be clearly mentioned in the communication.

The publication of this Cyber Security Advisory is an example of ABB’s commitment to the user community in support of this critical topic. Responsible disclosure is an important element in the chain of trust we work to maintain with our many customers. The release of an Advisory provides timely information which is essential to help ensure our customers are fully informed.

Purpose

What causes this vulnerability?

The vulnerability is caused by SharpZipLib allowing attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip archive entry that is mishandled during extraction (i.e., changing the intended destination directory). This vulnerability is also known as 'Zip-Slip'.

What is SharpZipLib?

SharpZipLib is a compression/extraction library. It provides support for various compression and archive formats extraction.

What might an attacker use the vulnerability to do?

An attacker who successfully exploited this vulnerability could insert and run arbitrary code in a directory higher in the hierarchy than the destination extraction folder.

How could an attacker exploit vulnerability?

An attacker could try to exploit this vulnerability by creating a specially crafted compressed file and extracting the file to an affected system node. This would require that the attacker has local authenticated access to the system.

Could this vulnerability be exploited remotely?

No, to exploit this vulnerability an attacker would need to have local access to the affected system node.

Can functional safety be affected by an exploit of this vulnerability?

Yes. If successfully exploited, functional safety could be compromised if e.g., a configuration modified by an attacker is imported into a device performing safety-critical operations, such as a protection relay.

What does the update do?

The update eliminates this vulnerability by removing the affected component.

When this security advisory was issued, had this vulnerability been publicly disclosed?

Yes, this vulnerability has been publicly disclosed.

When this security advisory was issued, had ABB received any reports that this vulnerability was being exploited?

No, ABB had not received any information indicating that this vulnerability had been exploited when this security advisory was originally issued.

Frequently Asked Questions

Summary: 1MRS758440, Rev. H PCM600 Cyber Security Deployment Guideline

PCM600 SharpZip library vulnerability

Summary: Initial version.

ABB

Protection and Control IED manager

ABB Protection and Control IED manager PCM600 >=1.5|<=2.13

ABB Protection and Control IED manager PCM600 2.14

A vulnerability exists in the SharpZip.dll included in the product versions listed above. An attacker could exploit vulnerability by providing a specially crafted message to the system node, causing insertion, and running of arbitrary code.

CVE description

Summary: NVD - CVE-2018-1002208

The problem is corrected in the following product version:

ABB Protection and control IED manager PCM600 version 2.14.

ABB recommends that customers apply the update at earliest convenience.

Note: RE_630 protection relays are not compatible with PCM600 version 2.14. When using earlier PCM600 versions with RE_630, the known vulnerability must be mitigated through system-level defenses. For mitigation guidance, refer to the General Security Recommendations.

CVE-2018-1002208


An update is available that resolves a publicly reported vulnerability in the product versions listed as affected in the advisory.
An attacker who successfully exploited these vulnerabilities could call shell functions (CVE-2023-6357),
crash the PLC (CVE-2024-5000), crash the web server of the PLC (CVE-2024-8175), grant read access to
files (CVE-2024-12429) or enable command execution (CVE-2024-12430).
The vulnerabilities CVE-2023-6357, CVE-2024-12429 and CVE-2024-12430 require successful authentication.

Summary

For any installation of software-related ABB products we strongly recommend the following (non-exhaustive) list of cyber security practices:
– Isolate special purpose networks (e.g. for automation systems) and remote devices behind firewalls
and separate them from any general-purpose network (e.g. office or home networks).
– Install physical controls so no unauthorized personnel can access your devices, components, peripheral equipment, and networks.
– Never connect programming software or computers containing programming software to any network other than the network for the devices that it is intended for.
– Scan all data imported into your environment before use to detect potential malware infections.
– Minimize network exposure for all applications and endpoints to ensure that they are not accessible
from the Internet unless they are designed for such exposure and the intended use requires such.
– Ensure all nodes are always up to date in terms of installed software, operating system, and firmware
patches as well as anti-virus and firewall.
– When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices

General security recommendations

For additional instructions and support please contact your local ABB service organization. For contact
information, see www.abb.com/contactcenters.
Information about ABB’s cyber security program and capabilities can be found at www.abb.com/cybersecurity.

Support

The information in this document is subject to change without notice, and should not be construed as a
commitment by ABB.
ABB provides no warranty, express or implied, including warranties of merchantability and fitness for a
particular purpose, for the information contained in this document, and assumes no responsibility for
any errors that may appear in this document. In no event shall ABB or any of its suppliers be liable for direct, indirect, special, incidental or consequential damages of any nature or kind arising from the use of
this document, or from the use of any hardware or software described in this document, even if ABB or
its suppliers have been advised of the possibility of such damages.
This document and parts hereof must not be reproduced or copied without written permission from
ABB, and the contents hereof must not be imparted to a third party nor used for any unauthorized purpose.
All rights to registrations and trademarks reside with their respective owners.

Notice

Workarounds are specific measures that a user can take to help block an attack, for example, temporarily disabling the vulnerable feature may remove the exposure with well-known impact on functionality.
ABB has tested the following workarounds. Although these workarounds will not correct the underlying
vulnerability, they can help block known attack vectors. When a workaround reduces functionality, this is
identified below as “Impact of workaround”.
To exploit the vulnerabilities CVE-2023-6357, CVE-2024-12429 and CVE-2024-12430, successful authentication is required. Therefore, the affected products shall only be used with activated user management
and by setting strong passwords. Details regarding the device user management are available from the
application note “AC500 User Management with V3”.
ABB strongly recommends using the online user management. This not only prevents an attacker from
downloading and execute malicious code, but also suppresses start, stop, debug, or other actions on a known working application that could potentially disrupt a machine or system.

Workarounds

Refer to section “General security recommendations” for further advise on how to keep your system secure

Mitigating factors

Summary: CVE-2023-6357: CODESYS Control V3 on Linux and QNX operating systems

Summary: CVE-2024-5000: CODESYS Control V3 - OPC UA Stack

Summary: CVE-2024-8175: CODESYS Control V3 web server

Summary: Application note: AC500 User Management with V3

Summary: Automation Builder 2.8.0

AC500 V3 Multiple vulnerabilities

Summary: Initial version.

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

A successfully authenticated control programmer could exploit this vulnerability to inject calls to additional operating system shell functions via the SysFile or CAA file system libraries.

CVE description

Summary: NVD - CVE-2023-6357

The problem is corrected in AC500 V3 firmware version 3.8.0.

ABB recommends that customers apply the update at earliest convenience. This firmware version is released for all AC500 V3 PLC types and available from Automation Builder 2.8.0.

CVE-2023-6357

The OPC UA stack, implemented by the CmpOPCUAStack component, is an optional part of the runtime
system. Both the OPC UA Server and the OPC UA Client of the runtime system use the OPC UA Stack as a
common implementation. The OPC UA protocol enables data exchange between the runtime system and
OPC UA clients such as SCADA or HMIs, or OPC UA servers such as PLCs or other devices.
If a runtime system containing the CmpOPCUAStack component receives a specially crafted request/response, the required buffer size in the OPC UA server/client may be incorrectly calculated. This can lead
to a crash of the runtime system during the subsequent initialization of the receive buffer with zero.
An attacker can exploit this vulnerability by using a malicious OPC UA client to send a crafted request to
the AC500 V3 PLC with an affected OPC UA server. Conversely, AC500 V3 PLCs with an affected OPC UA
client can be crashed if they have connected to a malicious OPC UA server. The runtime systems usually
contain both the OPC UA client and the server.

CVE description

Summary: NVD - CVE-2024-5000

CVE-2024-5000

Improper Check for Unusual or Exceptional Conditions

The AC500 V3 web server, implemented by the CmpWebServer component, is an optional part of the
runtime system. It is used by the AC500 V3 WebVisu to display visualization screens in a web browser.
The AC500 V3 web server supports both the HTTP and HTTPS protocols. Because the AC500 V3 web
server does not correctly check the return value of an underlying function, it reacts in a wrong way to
specifically crafted TLS packets that are received via an HTTPS connection. This causes the AC500 V3
web server to access invalid memory and the web server task to crash.

CVE description

Summary: NVD - CVE-2024-8175

CVE-2024-8175

Summary: reporting the vulnerabilities through responsible disclosure

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

AC500 V3 PLC has a slot for memory cards that can be used e.g. for logging purposes or for updating
the firmware or the boot application. Because the AC500 V3 does not correctly validate the content of
the memory card, a specifically crafted memory card can be used for directory traversal. A successfully
authenticated attacker can use this vulnerability to read system-wide files and configuration

CVE description

Summary: NVD - CVE-2024-12429

CVE-2024-12429

Improper Handling of Insufficient Permissions or Privileges

After successfully exploiting CVE-2024-12429 (directory traversal), a successfully authenticated attacker
can inject arbitrary commands into a specifically crafted file, which then will be executed by root user

CVE description

Summary: NVD - CVE-2024-12430

CVE-2024-12430


ABB is aware of vulnerabilities in the product versions listed as affected in the following section.

An attacker who successfully exploited this vulnerability could overrule the Automation Builder’s user management. Workarounds to close the vulnerabilities are available.

Summary

Workarounds are specific measures that a user can take to help block an attack, for example, temporarily disabling the vulnerable feature may remove the exposure with well-known impact on functionality.
ABB has tested the following workarounds. Although these workarounds will not correct the underlying vulnerability, they can help block known attack vectors. When a workaround reduces functionality, this is
identified below as “Impact of workaround”.

To exploit the vulnerabilities, access the project on file level is required. This can be prevented by the security settings of the Automation Builder projects, accessible via the menu “Project” → “Project
Settings…” → “Security”.

• CVE-2025-3394: In the project settings, set “Security” to “Integrity check”. This prevents anyone
to access or modify the content of the Automation Builder project file. Projects can be opened
and used without any limitations.

• CVE-2025-3395: In the project settings, set “Security” to “Encryption”. This prevents unauthorized users to open the project. Authorized users can open the project and with that exploit the
vulnerability

Workarounds

For any installation of software related ABB products we strongly recommend the following (non-exhaustive) list of cyber security practices:
– Isolate special purpose networks (e.g. for automation systems) and remote devices behind firewalls
and separate them from any general-purpose network (e.g. office or home networks).
– Install physical controls so no unauthorized personnel can access your devices, components, peripheral equipment, and networks.
– Never connect programming software or computers containing programing software to any network other than the network for the devices that it is intended for.
– Scan all data imported into your environment before use to detect potential malware infections.
– Minimize network exposure for all applications and endpoints to ensure that they are not accessible
from the Internet unless they are designed for such exposure and the intended use requires such.
– Ensure all nodes are always up to date in terms of installed software, operating system, and firmware
patches as well as anti-virus and firewall.
– When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.

General security recommendations

The information in this document is subject to change without notice, and should not be construed as a
commitment by ABB.
ABB provides no warranty, express or implied, including warranties of merchantability and fitness for a
particular purpose, for the information contained in this document, and assumes no responsibility for
any errors that may appear in this document. In no event shall ABB or any of its suppliers be liable for direct, indirect, special, incidental or consequential damages of any nature or kind arising from the use of
this document, or from the use of any hardware or software described in this document, even if ABB or
its suppliers have been advised of the possibility of such damages.
This document and parts hereof must not be reproduced or copied without written permission from
ABB, and the contents hereof must not be imparted to a third party nor used for any unauthorized purpose.
All rights to registrations and trademarks reside with their respective owners

Notice

Support

Immediate workarounds to close the vulnerabilities are:

• CVE-2025-3394: In the project settings, set “Security” to “Integrity check”

• CVE-2025-3395: In the project settings, set “Security” to “Encryption”
ABB recommends that customers apply the workarounds at earliest convenience.

With the latest Automation Builder version (starting with version 2.8.1), the default for “Security” is set
to “Integrity check”. By keeping this default unchanged, CVE-2025-3394 cannot be exploited.

Mitigating factors

ABB Automation Builder Vulnerabilities in user management and access control

Summary: Initial Version

Summary: Final

Incorrect Permission Assignment for Critical Resource

Automation Builder stores all user management information in the project file. Despite fully encrypted
password data, an attacker could try to modify parts of the Automation Builder project file by specially
crafted contents so that the user management will be overruled.

CVE Description

Summary: NVD - CVE-2025-3394:

Immediate workarounds to close the vulnerability:

• CVE-2025-3394: In the project settings, set “Security” to “Integrity check”

ABB recommends that customers apply the workarounds at earliest convenience.
With the next Automation Builder version 2.8.1, the default for “Security” will be set to “Integrity check”.
The release of Automation Builder version 2.8.1 is scheduled for July 2025.

CVE-2025-3394

Automation Builder projects including AC500 V2 or SM560-S devices contain the application files for
these devices. An attacker could try to modify parts of these files so that the project can be changed by
overruling the Automation Builder user management.

CVE Description

Summary: NVD - CVE-2025-3395

Immediate workarounds to close the vulnerability:

• CVE-2025-3395: In the project settings, set “Security” to “Encryption”

ABB recommends that customers apply the workarounds at earliest convenience.
With the next Automation Builder version 2.8.1, the default for “Security” will be set to “Integrity check”.
The release of Automation Builder version 2.8.1 is scheduled for July 2025.

CVE-2025-3395


Summary: reporting the vulnerabilities through responsible disclosure.

© Copyright 2025 ABB. All rights reserved.

ABB became aware of vulnerabilities in AC500 V2 listed as affected in the advisory.
An attacker who successfully exploited this vulnerability could access fragments of Modbus telegrams that have been sent earlier by that PLC

Summary

For any installation of software-related ABB products we strongly recommend the following (non-exhaustive) list of cyber security practices:
–	Isolate special purpose networks (e.g. for automation systems) and remote devices behind firewalls and separate them from any general-purpose network (e.g. office or home networks).
–	Install physical controls so no unauthorized personnel can access your devices, components, peripheral equipment, and networks.
–	Never connect programming software or computers containing programing software to any net-work other than the network for the devices that it is intended for.
–	Scan all data imported into your environment before use to detect potential malware infections.
–	Minimize network exposure for all applications and endpoints to ensure that they are not accessible from the Internet unless they are designed for such exposure and the intended use requires such.
–	Ensure all nodes are always up to date in terms of installed software, operating system, and firmware patches as well as anti-virus and firewall.
–	When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices

General security recommendations

For additional instructions and support please contact your local ABB service organization. For contact information, see www.abb.com/contactcenters.
Information about ABB’s cyber security program and capabilities can be found at www.abb.com/cybersecurity

Support

The information in this document is subject to change without notice, and should not be construed as a commitment by ABB.
ABB provides no warranty, express or implied, including warranties of merchantability and fitness for a particular purpose, for the information contained in this document, and assumes no responsibility for any errors that may appear in this document. In no event shall ABB or any of its suppliers be liable for direct, indirect, special, incidental or consequential damages of any nature or kind arising from the use of this document, or from the use of any hardware or software described in this document, even if ABB or its suppliers have been advised of the possibility of such damages.
This document and parts hereof must not be reproduced or copied without written permission from ABB, and the contents hereof must not be imparted to a third party nor used for any unauthorized purpose.
All rights to registrations and trademarks reside with their respective owners.

Notice

Mitigating factors describe conditions and circumstances that make an attack that exploits the vulnerability difficult or less likely to succeed.
Regarding this vulnerability it is recommended to

•	Do not use the Modbus server for sending any sensitive data, as fragments might be accessible even after the initial sending of the response

•	Only use supported Modbus function codes, as invalid responses to unsupported function codes might have negative effects on the requesting Modbus client.
Refer to section “General security recommendations” for further advise on how to keep your system secure.

Mitigating factors

AC500 V2 Buffer overread on Modbus protocol

Summary: Initial version.

Sending unsupported function codes to the AC500 V2 Modbus server might result in invalid responses. Fragments of previous responses might be added to the end of the response.

CVE description

Summary: NVD - CVE-2025-7745

The vulnerabilities have been resolved in the following product versions:
AC500 V2 firmware version 2.5.3 (released in 2016) and later

CVE-2025-7745


ABB became aware of severe vulnerability in the products versions listed as affected in the advisory. An update is available that resolves these vulnerabilities.

An attacker who successfully exploited these vulnerabilities could bypass the user management and read visualization files (CVE-2025-2595), read and write certificates and keys (CVE-2025-41659) or cause a denial-of-service (DoS) (CVE-2025-41691).

Summary

For additional instructions and support please contact your local ABB service organization. For contact information, see www.abb.com/contactcenters.

Information about ABB’s cyber security program and capabilities can be found at www.abb.com/cybersecurity.

Support

The information in this document is subject to change without notice, and should not be construed as a commitment by ABB.

ABB provides no warranty, express or implied, including warranties of merchantability and fitness for a particular purpose, for the information contained in this document, and assumes no responsibility for any errors that may appear in this document. In no event shall ABB or any of its suppliers be liable for direct, indirect, special, incidental or consequential damages of any nature or kind arising from the use of this document, or from the use of any hardware or software described in this document, even if ABB or its suppliers have been advised of the possibility of such damages.

This document and parts hereof must not be reproduced or copied without written permission from ABB, and the contents hereof must not be imparted to a third party nor used for any unauthorized purpose.

All rights to registrations and trademarks reside with their respective owners.

Notice

For any installation of software-related ABB products we strongly recommend the following (non-exhaustive) list of cyber security practices:

- Isolate special purpose networks (e.g. for automation systems) and remote devices behind fire-walls and separate them from any general-purpose network (e.g. office or home networks).
- Install physical controls so no unauthorized personnel can access your devices, components, peripheral equipment, and networks.
- Never connect programming software or computers containing programming software to any network other than the network for the devices that it is intended for.
- Scan all data imported into your environment before use to detect potential malware infections.
- Minimize network exposure for all applications and endpoints to ensure that they are not accessible from the Internet unless they are designed for such exposure and the intended use requires such.
- Ensure all nodes are always up to date in terms of installed software, operating system, and firmware patches as well as anti-virus and firewall.
- When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.

General security recommendations

ABB has a rigorous internal cyber security continuous improvement process which involves regular testing with industry leading tools and periodic assessments to identify potential product issues. Occasionally an issue is determined to be a design or coding flaw with implications that may impact product cyber security.

When a potential product vulnerability is identified or reported, ABB immediately initiates our vulnerability handling process. This entails validating if the issue is in fact a product issue, identifying root causes, determining what related products may be impacted, developing a remediation, and notifying end users and governmental organizations.

The resulting Cyber Security Advisory intends to notify customers of the vulnerability and provide details on which products are impacted, how to mitigate the vulnerability or explain workarounds that minimize the potential risk as much as possible. The release of a Cyber Security Advisory should not be misconstrued as an affirmation or indication of an active threat or ongoing campaign targeting the products mentioned here. If ABB is aware of any specific threats, it will be clearly mentioned in the communication.

The publication of this Cyber Security Advisory is an example of ABB’s commitment to the user community in support of this critical topic. Responsible disclosure is an important element in the chain of trust we work to maintain with our many customers. The release of an Advisory provides timely information which is essential to help ensure our customers are fully informed.

Purpose

What causes the vulnerability?
- Refer to section “Vulnerability severity and details“.

What is AC500 V3?
- The AC500 V3 is a scalable range of Programmable Logic Controller (PLC). It provides solutions for small, medium and high-end applications. The AC500 V3 platform offers different performance levels and is the ideal choice for high availability, extreme environments, condition monitoring, motion control or safety solutions. It offers interoperability and compatibility in hardware and software from compact PLCs up to high end and safety PLCs.

What might an attacker use the vulnerability to do?
- An attacker who successfully exploited these vulnerabilities could bypass the user management and read visualization files (CVE-2025-2595), read and write certificates and keys (CVE-2025-41659) or cause a denial-of-service (DoS) (CVE-2025-41691).

How could an attacker exploit the vulnerability?
- Refer to section “Vulnerability severity and details“.

Could the vulnerability be exploited remotely?
- Yes, an attacker who has network access to an affected system node could exploit the vulnerabilities. Recommended practices include that process control systems are physically protected, have no direct connections to the Internet, and are separated from other networks by means of a firewall system that has a minimal number of ports exposed.

When this security advisory was issued, had this vulnerability been publicly disclosed?
- Yes, the vulnerabilities have been publicly disclosed.

When this security advisory was issued, had ABB received any reports that this vulnerability was being exploited?
- No, ABB had not received any information indicating that this vulnerability had been exploited when this security advisory was originally issued.

Frequently Asked Questions

Summary: 2025-05 CODESYS Visualization user management bypass in WebVisu

Summary: 2025-07 CODESYS Control V3 - Exposed PKI folder

Summary: 2025-08 CODESYS Control V3 - NULL Pointer Dereference

AC500 V3 Multiple vulnerabilities

Summary: Initial version.

The visualization allows users to create browser-based visualizations for monitoring and controlling industrial processes. Access to these visualizations can be restricted using the built-in user management.

However, an unauthenticated remote attacker can bypass the user management and read visualization files by means of forced browsing. The exposed files, accessible via a web browser, contain only static visualization data such as text lists, icons or images, but no live data from the controlled system.

CVE description

Summary: NVD - CVE-2025-2595

The problem is corrected in the following product versions:
- AC500 V3 firmware version 3.9.0

ABB recommends that customers apply the update at earliest convenience. This firmware version is released for all AC500 V3 PLC types and available from Automation Builder 2.9.0. Automation Builder 2.9.0 is available for download from the related download site.

https://www.abb.com/global/en/areas/motion/digital-tools/automation-builder/software-download

Refer to section “General security recommendations” for further advise on how to keep your system secure.

CVE-2025-2595

A vulnerability in the runtime system allows low-privileged remote attackers to access the PKI folder via CODESYS protocol, enabling them to read and write certificates and keys. This exposes sensitive cryptographic data and allows unauthorized certificates to be trusted. However, all services remain available, only certificate based encryption and signing features are concerned. The issue affects systems using the optional CmpOpenSSL component for cryptographic operations.

CVE description

Summary: NVD - CVE-2025-41659

CVE-2025-41659

A vulnerability in the runtime system's CmpDevice component allows unauthenticated attackers to cause a denial-of-service (DoS) via specially crafted communication requests.

The issue is triggered by a NULL pointer dereference and also affects systems when outdated clients attempt to log in.

CVE description

Summary: NVD - CVE-2025-41691

CVE-2025-41691