Summary: reporting the vulnerabilities through responsible disclosure.

ABB is aware of vulnerabilities in the product versions listed as affected in the advisory.

An attacker who successfully exploited this vulnerability could cause the pollution of heap memory which potentially takes remote control of the product and performs a write operation to the flash memory to alter the firmware behavior.

Summary

For additional instructions and support please contact your local ABB ASKI service organization. For contact information, see https://www.aski-energy.com/en/contact/

Information about ABB’s cyber security program and capabilities can be found at www.abb.com/cybersecurity

Support

Notice

Mitigating factors describe conditions and circumstances that make an attack that exploits the vulnerability difficult or less likely to succeed.

– Ensure the product is not exposed to the public internet.

– Within the control system, put the product behind firewall, to strictly control network traffic only from limited whitelisted IPs or alternatively, route the traffic through a secure proxy that enforces authentication and logging.

– Monitor product access using firewall, IDS, or IPS, and configure alerts for any access attempts from non-whitelisted IPs.

– Ensure surrounding systems are fully updated to reduce attack vectors.

Refer to section “General security recommendations” for further advise on how to keep your system secure.

Mitigating factors

Workarounds are specific measures that a user can take to help block an attack. ABB has tested the following workarounds. Although these workarounds will not correct the underlying vulnerability, they can help block known attack vectors. When a workaround reduces functionality, this is identified below as “Impact of workaround”.

– Physically disconnect the ethernet port if embedded web server is not being used.

Impact of workaround

The embedded web server and all its functionalities, incl. load monitoring, alarms, remote configuration, etc. will not be accessible. However, the product will continue functioning as normal based on configured control parameters.

Workarounds

For any installation of software-related ABB products we strongly recommend the following (non-exhaustive) list of cyber security practices:

– Isolate special purpose networks (e.g. for automation systems) and remote devices behind firewalls and separate them from any general-purpose network (e.g. office or home networks).

– Install physical controls so no unauthorized personnel can access your devices, components, peripheral equipment, and networks.

– Never connect programming software or computers containing programing software to any network other than the network for the devices that it is intended for.

– Scan all data imported into your environment before use to detect potential malware infections.

– Minimize network exposure for all applications and endpoints to ensure that they are not accessible from the Internet unless they are designed for such exposure and the intended use requires such.

– Ensure all nodes are always up to date in terms of installed software, operating system, and firmware patches as well as anti-virus and firewall.

– When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.

General security recommendations

Purpose

What causes the vulnerability?

The vulnerability is caused by lack of access controls present in the embedded web server in the ALSmini-S4/S8 IP controllers.

Where to check for serial number?

Product serial number is printed on the side of ALS -mini-S4/S8 IP controllers. Additionally, users can also identify serial number through controller menu, as mentioned in product user manual - page 11.

What is ALS-mini?

It is an intelligent energy controller for load optimization using instantaneous value control.

What might an attacker use the vulnerability to do?

An attacker who successfully exploited this vulnerability could take remote control of the product and change product configuration.

How could an attacker exploit the vulnerability?

An attacker could exploit vulnerability by merely accessing the wrongly configured ALS-mini-S4/S8 IP controllers in the network. This would mean that the product is exposed to public Internet, or the attacker has access to the system network, by connecting to the network either directly or through a wrongly configured or penetrated firewall, or that he installs malicious software on a system node or otherwise infects the network with malicious software. Recommended practices help mitigate such attacks, see section Mitigating Factors above or apply Workarounds to completely eliminate the attack vector.

Could the vulnerability be exploited remotely?

Yes, an attacker who has network access to an affected system node could exploit this vulnerability. Recommended practices include that process control systems are physically protected, have no direct connections to the Internet, and are separated from other networks by means of a firewall system that has a minimal number of ports exposed.

When this security advisory was issued, had this vulnerability been publicly disclosed?

No, ABB received information about this vulnerability through responsible disclosure.

When this security advisory was issued, had ABB received any reports that this vulnerability was being exploited?

No, ABB had not received any information indicating that this vulnerability had been exploited when this security advisory was originally issued.

Frequently asked questions

Summary: 19014 v2.1  Product user manual - ALS-mini-s (IP) Technisches Handbuch

ALS-mini-S4/S8 IP Missing Authentication Vulnerability and its Mitigations

Summary: Initial version.

Summary: Updated CVSS 3.1 score

The critical severity vulnerability exists in the embedded web server of the ALS-mini-S4/S8 IP controllers. There is a lack of authentication functionality. Specifically, an attacker can read and modify product configuration parameters without being authenticated

CVE description

Summary: NVD - CVE-2025-9574

ABB recommends that customers correctly configure the device in the network by referring to section

Mitigating factors, or apply Workarounds to completely eliminate the attack vector.

CVE-2025-9574


© Copyright 2025 ABB. All rights reserved.

ABB became aware of an internally discovered vulnerability in the MConfig product versions listed as affected in the advisory.

An attacker with access to local networks who successfully exploits vulnerability could have access to application’s sensitive information.

ABB strongly advises customers to update MConfig with latest software version.

Summary

For any installation of software-related ABB products we strongly recommend the following (non-exhaustive) list of cyber security practices:
- Isolate special purpose networks (e.g. for automation systems) and remote devices behind firewalls and separate them from any general-purpose network (e.g. office or home networks).
- Install physical controls so no unauthorized personnel can access your devices, components, peripheral equipment, and networks.
- Never connect programming software or computers containing programming software to any
network other than the network for the devices that it is intended for.
- Scan all data imported into your environment before use to detect potential malware infections.
- Minimize network exposure for all applications and endpoints to ensure that they are not accessible from the Internet unless they are designed for such exposure and the intended use requires
such.
- Ensure all nodes are always up to date in terms of installed software, operating system, and
firmware patches as well as anti-virus and firewall.
- When remote access is required, use secure methods, such as Virtual Private Networks (VPNs).
Recognize that VPNs may have vulnerabilities and should be updated to the most current version
available. Also, understand that VPNs are only as secure as the connected devices.

General security recommendations

For additional instructions and support please contact your local ABB service organization. For contact information, see www.abb.com/contactcenters.

Information about ABB’s cyber security program and capabilities can be found at www.abb.com/cybersecurity

Support

The information in this document is subject to change without notice, and should not be construed as a commitment by ABB.

ABB provides no warranty, express or implied, including warranties of merchantability and fitness for a particular purpose, for the information contained in this document, and assumes no responsibility for any errors that may appear in this document. In no event shall ABB or any of its suppliers be liable for direct, indirect, special, incidental or consequential damages of any nature or kind arising from the use of this document, or from the use of any hardware or software described in this document, even if ABB or its suppliers have been advised of the possibility of such damages.

This document and parts hereof must not be reproduced or copied without written permission from ABB, and the contents hereof must not be imparted to a third-party nor used for any unauthorized purpose.

All rights to registrations and trademarks reside with their respective owners.

Notice

Mitigating factors describe conditions and circumstances that make an attack that exploits the vulnerability difficult or less likely to succeed.

In case customer cannot upgrade the firmware or it is not feasible then please immediately apply mitigating factors mentioned in “General security recommendations”.

Mitigating factors

ABB has a rigorous internal cyber security continuous improvement process which involves regular testing with industry leading tools and periodic assessments to identify potential product issues. Occasionally an issue is determined to be a design or coding flaw with implications that may impact product cyber security.

When a potential product vulnerability is identified or reported, ABB immediately initiates our vulnerability handling process. This entails validating if the issue is in fact a product issue, identifying root causes, determining what related products may be impacted, developing a remediation, and notifying end users and governmental organizations.

The resulting Cyber Security Advisory intends to notify customers of the vulnerability and provide details on which products are impacted, how to mitigate the vulnerability or explain workarounds that minimize the potential risk as much as possible. The release of a Cyber Security Advisory should not be misconstrued as an affirmation or indication of an active threat or ongoing campaign targeting the products mentioned here. If ABB is aware of any specific threats, it will be clearly mentioned in the communication.

The publication of this Cyber Security Advisory is an example of ABB’s commitment to the user community in support of this critical topic. Responsible disclosure is an important element in the chain of trust we work to maintain with our many customers. The release of an Advisory provides timely information which is essential to help ensure our customers are fully informed.

Purpose

What causes the vulnerability?

The vulnerability is caused by code defect allowing the attacker to extract the sensitive information such as user credentials from memory dump of the application. Please refer to Vulnerability severity and details for further details.

What is MConfig ?

MConfig is the parameterizing software for ABB LV switchgear components such as motor and feeder controller, operation panel, temperature monitoring solutions and protocol converter. The components are physically installed in a low voltage switchgear located in switch rooms that require authority to access.
To run this software on a host machine (computer), the operating system should be Win11 or later version.

What might an attacker use the vulnerability to do?

If the mentioned vulnerability has been successfully exploited by an attacker, this could allow the attacker to extract sensitive information such as user credentials.

With user credentials and access to a host machine with MConfig installed, and access to the switch room with components installed in a switchgear, the attacker can modify the setting of the components potentially compromising its correct operation.

How could an attacker exploit vulnerability?

An attacker with host machine physical access could, after a user log into MConfig, exploit a vulnerability by exporting a memory dump during runtime, potentially exposing the user's password.

Could vulnerability be exploited remotely?

The vulnerability can only be exploited if an attacker has physical access to the host machine with MConfig software.

What does the update do?

MConfig version V1.4.9.22 update has fix for the vulnerability mentioned in Vulnerability severity and details section.

The measures below were implemented to fix the vulnerability:

• Clear any authentication-related memory data after a successful login.

• Hash the passwords in SHA256

Frequently asked questions

Summary: ABB CYBERSECURITY ADVISORY - PDF version.

Summary: ABB CYBERSECURITY ADVISORY - CSAF version.

LVS MConfig Insecure memory handling

Summary: Initial version.

Cleartext Storage of Sensitive Information in Memory

During the runtime of the MConfig Software application, an attacker can export the memory dump file into the operating system. If passwords are stored in plain text in memory, they will be included in these dump files. If such dump files are mishandled, attackers could obtain them and extract the passwords.

CVE Description

Summary: NVD -CVE-2025-9970

The vulnerability is resolved in the following product versions:

MConfig version 1.4.9.22

ABB advises users to update their devices to the latest software version.

Additionally, ABB recommends implementing defensive measures to reduce the risk of vulnerability exploitation, as outlined in the product instruction manual. Please refer to the section “Mitigation factors” for more information

CVE-2025-9970


© Copyright 2024 ABB. All rights reserved.

ABB is aware of a vulnerability related to the VideONet product. The vulnerability is applicable in the System 800xA versions listed as affected in the advisory, where the VideONet product is used. There will be no update/resolution of this vulnerability in System 800xA. Instead, the strategy for ABB is to offer existing customers using VideONet a transfer to a new product, Camera Connect. This will be offered as soon as Camera Connect is available as a product.
An attacker who successfully exploited the vulnerability could, in the worst-case scenario, stop or manipulate the video feed.
There is no impact to other Operator station functions (graphics, trends, faceplates, etc.) and Control operations are not impacted at all.

Summary

Control systems and the control network are exposed to cyber threats. In order to minimize these risks, the protective measures and best practices listed below are available in addition to other measures. ABB strongly recommends system integrators and asset owners to implement the measures they consider appropriate for their control system environment:

–	Place control systems in a dedicated control network containing control systems only.

–	Locate control networks and systems behind firewalls and separate them from any other networks like business networks and the Internet.

–	Block any inbound Internet traffic destined for the control networks/systems. Place remote access systems used for remote control system access outside the control network.

–	Limit outbound Internet traffic originating from control systems/networks as much as possible. If control systems must talk to the Internet, tailor firewall rules to required resources allow only source IPs, destination IPs and services/destination ports which control systems definitely need to use for normal control operation.

–	If Internet access is required on occasion only, disable relevant firewall rules and enable them during the time window of required Internet access only. If supported by your firewall, define an expiry date and time for such rules after the expiry date and time, the firewall will disable the rule automatically.

–	Limit exposure of control networks/systems to internal systems. Tailor firewall rules allowing traffic from internal systems to control networks/systems to allow only source IPs, destination IPs and services/destination ports which are definitely required for normal control operation.

–	Create strict firewall rules to filter malicious network traffic targeting control system ("exploit traffic"). Exploit traffic may use network communication features like source routing, IP fragmentation and/or IP tunneling. If such features are not required for normal control operation, block them on your firewall.

–	If supported by your firewall, apply additional filters to allowed traffic which provide protection for control networks/systems. Such filters are provided by advanced firewall features like Application Control and Anti-Virus.

–	Use Intrusion Detection Systems (IDS) or Intrusion Preventions Systems (IPS) to detect/block control system specific exploit traffic. Consider using IPS rules protecting against control system exploits.

–	When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Please ensure that VPN solutions are updated to the most current version available.

–	In case you want to filter internal control network traffic, consider using solutions supporting Intra-LAN traffic control like VLAN access control lists.

–	Harden your control systems by enabling only the ports, services and software required for normal control operation. Disable all other ports and disable/uninstall all other services and software.

–	If possible, limit the permissions of user accounts, software processes and devices to the permissions required for normal control operation.

–	Use trusted, patched software and malware protection solutions. Interact with trusted websites and trusted email attachments only.

–	Ensure all nodes are always up to date in terms of installed software, operating system and firmware patches as well as anti-virus and firewall.

–	Protect control systems from physical access by unauthorized personnel e.g. by placing them in locked switch cabinets.

More information on recommended practices can be found in the reference section (3BSE034463D6200).

General security recommendations

For additional instructions and support please contact your local ABB service organization. For contact information, see www.abb.com/contactcenters.
Information about ABB's cyber security program and capabilities can be found at www.abb.com/cybersecurity

Support

The information in this document is subject to change without notice, and should not be construed as a commitment by ABB.
ABB provides no warranty, express or implied, including warranties of merchantability and fitness for a particular purpose, for the information contained in this document, and assumes no responsibility for any errors that may appear in this document. In no event shall ABB or any of its suppliers be liable for direct, indirect, special, incidental or consequential damages of any nature or kind arising from the use of this document, or from the use of any hardware or software described in this document, even if ABB or its suppliers have been advised of the possibility of such damages.
This document and parts hereof must not be reproduced or copied without written permission from ABB, and the contents hereof must not be imparted to a third party nor used for any unauthorized purpose.
All rights to registrations and trademarks reside with their respective owners.

Notice

The only possible workaround is to secure and protect the network where VideONet is running and the VideONet Server from unauthorized access.
The workaround will not correct the underlying vulnerability, but it helps blocking known attack vectors.  Refer to section “General security recommendations” for further advise on how to keep your system secure.

Workarounds

Follow the guidelines in the System 800xA VideONet Connect user documentation (2PAA109407*) to secure and protect the installation of, and the network where VideONet is running.
Refer to section “General security recommendations” for further advice on how to keep your system secure.

Mitigating factors

Summary: ABB CYBERSECURITY ADVISORY - PDF version

Summary: System 800xA 6.2 Reference - Network Configuration (3BSE034463D6200)

Summary: System 800xA 6.2 Operations – VideONet Connect (2PAA109407D6200)

Summary: ABB CYBERSECURITY ADVISORY - CSAF version

System 800xA 5.1.x, 6.0.3.x, 6.1.1.x, 6.2.x - VideONet Camera passwords stored in clear text

Summary: Initial version.

Summary: There were some minor corrections

A vulnerability exists in the VideONet product included in the listed System 800xA versions, where VideONet is used.  An attacker who successfully exploited this vulnerability could retrieve the login credentials for all cameras and manipulate or stop the video feed.

CVE description

Summary: NVD - CVE-2024-10334

ABB recommends following the guidelines described in the System 800xA VideONet Connect user documentation (2PAA109407*). The user documentation explains how to protect the network on which cameras are connected from unauthorized access and the recommended deployment. Similarly, it is important to protect the VideONet Server from unauthorized access.
There will be no update for VideONet in System 800xA. Instead, the recommendation is to transfer to the new product, Camera Connect, as soon as it becomes available. Camera Connect is expected to be released in the first half of 2025. Customers may proactively reach out to their ABB contact in case they would like to receive further information about the new Camera Connect solution.
Ensure that the camera user accounts used by System 800xA only have the minimum level of permission needed to perform the required task, e.g. do not use an administrator or superuser account. This limits the potential damage from a leaked password.

CVE-2024-10334


Uri Sade
Roman Dvorkin
Roni Gavrilov
Eran Jacob

Summary: responsibly disclosing the vulnerability and providing valuable input on product improvements.

ABB is aware of a vulnerability in the product versions listed as affected in the advisory.

An attacker who successfully exploited this vulnerability could cause services to crash and restart by sending specifically crafted messages.

The vulnerability only affects 800xA services in PC based client/server nodes. Controllers are not affected by this vulnerability

Summary

Control systems and the control network are exposed to cyber threats. In order to minimize these risks, the protective measures and best practices listed below are available in addition to other measures. ABB strongly recommends system integrators and asset owners to implement the measures they consider appropriate for their control system environment:

- Place control systems in a dedicated control network containing control systems only.
- Locate control networks and systems behind firewalls and separate them from any other networks like business networks and the Internet.
- Block any inbound Internet traffic destined for the control networks/systems. Place remote access systems used for remote control system access outside the control network.
- Limit outbound Internet traffic originating from control systems/networks as much as possible. If control systems must talk to the Internet, tailor firewall rules to required resources - allow only source IPs, destination IPs and services/destination ports which control systems definitely need to use for normal control operation.
- If Internet access is required on occasion only, disable relevant firewall rules and enable them during the time window of required Internet access only. If supported by your firewall, define an expiry date and time for such rules – after the expiry date and time, the firewall will disable the rule automatically.
- Limit exposure of control networks/systems to internal systems. Tailor firewall rules allowing traffic
from internal systems to control networks/systems to allow only source IPs, destination IPs and services/destination ports which are definitely required for normal control operation.
- Create strict firewall rules to filter malicious network traffic targeting control system vulnerabilities ("exploit traffic"). Exploit traffic may use network communication features like source routing, IP fragmentation and/or IP tunneling. If such features are not required for normal control operation,
block them on your firewall.
- If supported by your firewall, apply additional filters to allowed traffic which provide protection for control networks/systems. Such filters are provided by advanced firewall features like Application Control and Anti-Virus.
- Use Intrusion Detection Systems (IDS) or Intrusion Preventions Systems (IPS) to detect/block control system-specific exploit traffic. Consider using IPS rules protecting against control system exploits.
- When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Please ensure that VPN solutions are updated to the most current version available.
- In case you want to filter internal control network traffic, consider using solutions supporting Intra LAN traffic control like VLAN access control lists.
- Harden your control systems by enabling only the ports, services and software required for normal control operation. Disable all other ports and disable/uninstall all other services and software.
- If possible, limit the permissions of user accounts, software processes and devices to the permissions required for normal control operation.
- Use trusted, patched software and malware protection solutions. Interact with trusted web sites and trusted email attachments only.
- Ensure all nodes are always up to date in terms of installed software, operating system and firmware patches as well as anti-virus and firewall.
- Protect control systems from physical access by unauthorized personnel e.g. by placing them in locked switch cabinets.

More information on recommended practices can be found in the reference section (3BSE034463-611)

General security recommendations

For additional instructions and support please contact your local ABB service organization. For contact information, see https://new.abb.com/contact-centers.

Information about ABB’s cyber security program and capabilities can be found at https://global.abb/group/en/technology/cyber-security.

Support

The information in this document is subject to change without notice, and should not be construed as a commitment by ABB.

ABB provides no warranty, express or implied, including warranties of merchantability and fitness for a particular purpose, for the information contained in this document, and assumes no responsibility for any errors that may appear in this document. In no event shall ABB or any of its suppliers be liable for direct, indirect, special, incidental or consequential damages of any nature or kind arising from the use of this document, or from the use of any hardware or software described in this document, even if ABB or its suppliers have been advised of the possibility of such damages.

This document and parts hereof must not be reproduced or copied without written permission from ABB, and the contents hereof must not be imparted to a third party nor used for any unauthorized purpose.

All rights to registrations and trademarks reside with their respective owners.

Notice

ABB has a rigorous internal cyber security continuous improvement process which involves regular testing with industry leading tools and periodic assessments to identify potential product issues. Occasionally an issue is determined to be a design or coding flaw with implications that may impact product cyber security.

When a potential product vulnerability is identified or reported, ABB immediately initiates our vulnerability handling process. This entails validating if the issue is in fact a product issue, identifying root causes, determining what related products may be impacted, developing a remediation, and notifying end users and governmental organizations (e.g. ICS-CERT).

The resulting Cyber Security Advisory intends to notify customers of the vulnerability and provide details on which products are impacted, how to mitigate the vulnerability or explain workarounds that minimize the potential risk as much as possible. The release of a Cyber Security Advisory should not be misconstrued as an affirmation or indication of an active threat or ongoing campaign targeting the products mentioned here. If ABB is aware of any specific threats, it will be clearly mentioned in the communication.

The publication of this Cyber Security Advisory is an example of ABB’s commitment to the user community in support of this critical topic. Responsible disclosure is an important element in the chain of trust we work to maintain with our many customers. The release of an Advisory provides timely information which is essential to help ensure our customers are fully informed.

Purpose

What is the scope of the vulnerability?
- An attacker who successfully exploited this vulnerability could, by using a malicious application that connects to a server application (applicable for all 800xA Base server applications), cause the server to crash by sending some specifically crafted message.

What causes the vulnerability?
- The vulnerability is caused by an unchecked buffer.

What is 800xA Base?
- 800xA Base is the core platform for System 800xA that consists of both core service applications for basic Workplace operations as well as a framework for other System 800xA products.

What is CSLib?
- CSLib is a TCP/IP based protocol that is commonly used by 800xA clients and services.

What might an attacker use the vulnerability to do?
- Denial of service. An attacker can create denial of services by continuously sending special crafted messages to the service in the system. The impacted service will be automatically restarted. For a redundant system using failover functionality there will be a failover to the redundant service, which may also be impacted by such an attack, stopping the affected service. The services will be attempted to be restarted by the System. However, if the attack is persistent, they will not be able to overcome this.

Note that repeated restarts of the affected service could be an indication of a compromise.

How could an attacker exploit the vulnerability?
- If the attacker has access to the Client/Server network and IPSec is not enabled the attacker can connect to the server applications using TCP/IP sockets and send specially crafted messages to exploit this.

The vulnerability only affects 800xA services in PC based client/server nodes. Controllers are not affected by this vulnerability.

Could the vulnerability be exploited remotely?
- If IPSec is not enabled there is a possibility to exploit remotely.

If IPSec is enabled the attacker would first need physical access to the system and plant a trojan or similar in a system node.

What does the update do?
- The unchecked buffer is now managed and checked in a secure way

When this security advisory was issued, had this vulnerability been publicly disclosed?
- No, ABB received information about this vulnerability through responsible disclosure.

When this security advisory was issued, had ABB received any reports that this vulnerability was being exploited?
- No, ABB had not received any information indicating that this vulnerability had been exploited when this security advisory was originally issued.

Frequently Asked Questions

Summary:
Refer below document for information about how to setup IPSec configuration.
- 2PAA111693-611 - System 800xA 6.1.1 Installation, Update and Upgrade - Post Installation

Summary:
Refer below document for information about ABB 800xA Base 6.0.3-10.
- 7PAA020635 800xA - Base 6.0.3-10, Release Notes

System 800xA SECURITY Advisory - ABB 800xA Base 6.0.x, 6.1.x CSLib communication DoS vulnerability

Summary: Initial version

Summary: Included CVSS v4.0 score

Summary: Updated the planned release date for ABB 800xA Base 6.0.3-x

Summary: Updated Affected Products and Recommended immediate actions

Summary: Updated Recommended immediate actions and References. Updated details about fix released in ABB 800xA Base 6.0.3-10

Improper Validation of Specified Quantity in Input

An attacker who successfully exploited this vulnerability could cause services to crash by sending specifically crafted messages

CVE Description

Summary: NVD - CVE-2024-3036

The problem is corrected in the following product versions:
- ABB 800xA Base 6.2.0-0 (part of System 800xA 6.2.0.0)
- ABB 800xA Base 6.1.1-3 (part of System 800xA 6.1.1.2)
- ABB 800xA Base 6.0.3-10 (RollUp released in September’2025. RollUp requires System 800xA 6.0.3.4 to be installed in the system. See References for more details.)

It is recommended to update to an active product version to obtain the latest corrections.

Refer to section “General security recommendations” for further advise on how to keep your system secure.

The system can be protected from network-based exploits of this vulnerability by enabling IPSec according to existing user documentation (See References).

CVE-2024-3036


ABB became aware of vulnerability in the products versions listed as affected in the advisory. The ABB S+ Engineering product versions are affected by vulnerabilities in PostgreSQL version 13.11 and earlier versions. If an attacker gains access to a site’s S+ Client Server network, they could exploit such vulnerabilities by executing arbitrary code and potentially compromising the entire system.

Summary

For additional instructions and support please contact your local ABB service organization. For contact information, see www.abb.com/contactcenters.

Information about ABB’s cyber security program and capabilities can be found at www.abb.com/cybersecurity.

Support

Notice

Control systems and the control network are exposed to cyber threats. In order to minimize these risks, the protective measures and best practices listed below are available in addition to other measures. ABB strongly recommends system integrators and asset owners to implement the measures they consider appropriate for their control system environment:

- Place control systems in a dedicated control network containing control systems only.
- Locate control networks and systems behind firewalls and separate them from any other networks like business networks and the Internet.
- Block any inbound Internet traffic destined for the control networks/systems. Place remote access systems used for remote control system access outside the control network.
- Limit outbound Internet traffic originating from control systems/networks as much as possible. If control systems must talk to the Internet, tailor firewall rules to required resources - allow only source IPs, destination IPs and services/destination ports which control systems definitely need to use for nor-mal control operation.
- If Internet access is required on occasion only, disable relevant firewall rules and enable them during the time window of required Internet access only. If supported by your firewall, define an expiry date and time for such rules – after the expiry date and time, the firewall will disable the rule automatically.
- Limit exposure of control networks/systems to internal systems. Tailor firewall rules allowing traffic from internal systems to control networks/systems to allow only source IPs, destination IPs and ser-vices/destination ports which are definitely required for normal control operation.
- Create strict firewall rules to filter malicious network traffic targeting control system vulnerabilities ("exploit traffic"). Exploit traffic may use network communication features like source routing, IP fragmentation and/or IP tunneling. If such features are not required for normal control operation, block them on your firewall.
- If supported by your firewall, apply additional filters to allowed traffic which provide protection for control networks/systems. Such filters are provided by advanced firewall features like Application Control and Anti-Virus.
- Use Intrusion Detection Systems (IDS) or Intrusion Preventions Systems (IPS) to detect/block control system-specific exploit traffic. Consider using IPS rules protecting against control system exploits.
- When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Please ensure that VPN solutions are updated to the most current version available.
- In case you want to filter internal control network traffic, consider using solutions supporting Intra-LAN traffic control like VLAN access control lists.
- Harden your control systems by enabling only the ports, services and software required for normal control operation. Disable all other ports and disable/uninstall all other services and software.
- If possible, limit the permissions of user accounts, software processes and devices to the permissions required for normal control operation.
- Use trusted, patched software and malware protection solutions. Interact with trusted web sites and trusted email attachments only.
- Ensure all nodes are always up to date in terms of installed software, operating system and firmware patches as well as anti-virus and firewall.
- Protect control systems from physical access by unauthorized personnel e.g. by placing them in locked switch cabinets.

For more information on recommended practices can be found in the following documents Please refer to the reference section.
- 8VZZ001006T0001
- 2PAA121027
- 8VZZ000602
- 7PAA018617
- 2PAA122516
- 2PAA120528
- 8VZZ000368D0066

General security recommendations

Purpose

What is the scope of the vulnerability?
- An attacker who successfully exploited these vulnerabilities could insert and run arbitrary code in the S+ system.

What causes the vulnerability?
- It is caused by several vulnerabilities in the PostgreSQL version 13.11 and earlier versions component used by the S+ Engineering product (see Affected products).

What might an attacker use the vulnerability to do?
- An attacker who successfully accessed the site’s S+ client/server network could cause a denial-of-service situation, corruptions of data or unauthorized disclosure of information.

How could an attacker exploit the vulnerability?
- To exploit the PostgreSQL vulnerabilities (see Vulnerability severity and details), an attacker should successfully access to the site’s S+ client/server network, remotely (through a wrongly configured or penetrated firewall) or even compromising a local machine and then accessing to PostgreSQL.

   Recommended practices help mitigate such attacks, see section Mitigating Factors above.

Could the vulnerability be exploited remotely?
- Yes, see the above How could an attacker exploit the vulnerability?
Recommended practices include that process control systems are physically protected, have no direct connections to the Internet, and are separated from other networks by means of a firewall system that has a minimal number of ports exposed.

Can functional safety be affected by an exploit of this vulnerability?
- Functional safety systems are not affected by these vulnerabilities

What does the update do?
- The S+ Engineering update removes the vulnerability by installing a secure updated PostgreSQL version.

When this security advisory was issued, had this vulnerability been publicly disclosed?
- Yes, PostgreSQL 13.11 vulnerabilities have been publicly disclosed.

When this security advisory was issued, had ABB received any reports that this vulnerability was being exploited?
- No, ABB had not received any information indicating that S+ Engineering had been exploited when this security advisory was originally issued.

Frequently Asked Questions

Summary: ABB CYBERSECURITY ADVISORY - PDF Version

Summary: ABB CYBERSECURITY ADVISORY - CSAF Version

Summary: 7PAA014844D2421 : S+ Engineering 2.4 SP2 Rollup 1 Release notes

Summary: 8VZZ001006T0001 : Symphony Plus Secure deployment guide for Windows 10 and Server 2016/2019 User manual

Summary: 2PAA121027 : Distributed Control Systems Trellix ePO with Endpoint Security and Application Control - Configuration Manual

Summary: 8VZZ000602 : Symphony Plus Security Updates Validation Status

Summary: 7PAA018617 : Symphony Plus Daily Validation of Anti-Malware Definition Updates

Summary: 2PAA122516 : System 800xA, Symphony Plus and Freelance - System Hardening - End user manual

Summary: 2PAA120528 : System 800xA, Symphony Plus and Freelance - System Hardening - Group Policies Overview

Summary: 8VZZ000368D0066 : ABB ICS Cyber Security Reference Architecture - Document

PostgreSQL vulnerabilities in ABB Ability™ Symphony® Plus Engineering

Summary: Initial version.

ABB

Ability™ Symphony® Plus

S+ Engineering

ABB Ability™ Symphony® Plus S+ Engineering  2.2

2.3 RU1

ABB Ability™ Symphony® Plus S+ Engineering  2.3 RU1

2.3 RU2

ABB Ability™ Symphony® Plus S+ Engineering  2.3 RU2

2.3 RU3

ABB Ability™ Symphony® Plus S+ Engineering  2.3 RU3

2.4 SP1

ABB Ability™ Symphony® Plus S+ Engineering  2.4 SP1

2.4 SP2 RU1

ABB Ability™ Symphony® Plus S+ Engineering  2.4 SP2 RU1

An attacker running as an authenticated PostgreSQL user can provide crafted data and trigger the integer overflow due to such missing overflow check. This can enable the execution of arbitrary code in the system.

CVE description

Summary: NVD - CVE-2023-5869

ABB advises all customers to review their installations to determine if they are using an impacted product as listed above, no further analysis or tools are needed to make this determination.

The recommended immediate actions per product are listed below:
- Systems using S+ Engineering 2.2 through 2.4 SP2 should upgrade to S+ Engineering 2.4 SP2 RU1 (re-leased in December 2024) or later.
- End users who are unable to install one of these updates should immediately look to implement the Mitigation and Workarounds listed below as this will restrict or prevent an attacker’s ability to com-promise the system.

ABB recommends that customers apply the update at the earliest convenience.

Any exploit of these vulnerabilities would require that the attacker has access to the site’s S+ client/server network. Following ABB’s recommended security practices, including network architecture and perimeter firewall, are mitigating factors in preventing external access to the S+ client/server net-work.

Refer to section “General security recommendations” for further advise on how to keep your system secure.

No workarounds are available. Assess the installation specific risk based on this advisory. Use the recommendations described under “Mitigating factors” or “Recommended immediate actions”.

CVE-2023-5869

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

If an administrator has installed Extension scripts and specific data is used inside a quoting con-struct, an attacker having proper PostgreSQL privileges can execute arbitrary code in the system as the administrator.

CVE description

Summary: NVD - CVE-2023-39417

CVE-2023-39417

Time-of-check Time-of-use (TOCTOU) Race Condition

A ‘time-of-check time-of-use’ (TOCTOU) race condition in a PostgreSQL can allow an attacker to easily execute arbitrary SQL functions by leveraging a PostgreSQL utility often executed with high privileges.

CVE description

Summary: NVD - CVE-2024-7348

CVE-2024-7348

An attacker can provide untrusted materialized views and lure a high privileged authorized user to inadvertently execute arbitrary SQL functions by refreshing the attacker's materialized view.

CVE description

Summary: NVD - CVE-2024-0985

CVE-2024-0985


Summary: sharing the information affecting a commonly used software component.

This vulnerability was privately reported relating to ABB’s implementation of the IEC 61850 communication stack for MMS client applications used in some Automation control system products.

Note: IEC 61850 communication typically supports MMS and GOOSE protocols. Some ABB products support both, others only MMS (e.g. S+ Operations and PM 877). In any case, GOOSE communication is not impacted by this reported vulnerability.

If an attacker gains access to a site’s IEC 61850 network, then exploiting this vulnerability will result in a device fault (PM 877, CI850 and CI868 modules) and will require a manual restart.

If this attack is directed at a S+ Operations node running IEC 61850 connectivity, this will result in a crash in the IEC 61850 communication driver which, if continued a repeating basis, will also result in a denial-of-service situation. Note that this does not have an impact on the overall availability and functionality of the S+ Operations node, only the IEC 61850 communication function.

The System 800xA IEC61850 Connect is not affected.

Summary

Support

Notice

Control systems and the control network are exposed to cyber threats. In order to minimize these risks, the protective measures and best practices listed below are available in addition to other measures. ABB strongly recommends system integrators and asset owners to implement the measures they consider appropriate for their control system environment:

- Place control systems in a dedicated control network containing control systems only.
- Locate control networks and systems behind firewalls and separate them from any other networks like business networks and the Internet.
- Block any inbound Internet traffic destined for the control networks/systems. Place remote access systems used for remote control system access outside the control network.
- Limit outbound Internet traffic originating from control systems/networks as much as possible. If control systems must talk to the Internet, tailor firewall rules to required resources - allow only source IPs, destination IPs and services/destination ports which control systems definitely need to use for normal control operation.
- If Internet access is required on occasion only, disable relevant firewall rules and enable them during the time window of required Internet access only. If supported by your firewall, define an expiry date and time for such rules – after the expiry date and time, the firewall will disable the rule automatically.
- Limit exposure of control networks/systems to internal systems. Tailor firewall rules allowing traffic from internal systems to control networks/systems to allow only source IPs, destination IPs and ser-vices/destination ports which are definitely required for normal control operation.
- Create strict firewall rules to filter malicious network traffic targeting control system vulnerabilities ("exploit traffic"). Exploit traffic may use network communication features like source routing, IP fragmentation and/or IP tunneling. If such features are not required for normal control operation, block them on your firewall.
- If supported by your firewall, apply additional filters to allowed traffic which provide protection for control networks/systems. Such filters are provided by advanced firewall features like Application Control and Anti-Virus.
- Use Intrusion Detection Systems (IDS) or Intrusion Preventions Systems (IPS) to detect/block control system-specific exploit traffic. Consider using IPS rules protecting against control system exploits.
- When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Please ensure that VPN solutions are updated to the most current version available.
- In case you want to filter internal control network traffic, consider using solutions supporting Intra-LAN traffic control like VLAN access control lists.
- Harden your control systems by enabling only the ports, services and software required for normal control operation. Disable all other ports and disable/uninstall all other services and software.
- If possible, limit the permissions of user accounts, software processes and devices to the permissions required for normal control operation.
- Use trusted, patched software and malware protection solutions. Interact with trusted web sites and trusted email attachments only.
- Ensure all nodes are always up to date in terms of installed software, operating system and firmware patches as well as anti-virus and firewall.
- Protect control systems from physical access by unauthorized personnel e.g. by placing them in locked switch cabinets.

For more information on recommended practices, please refer to the following documents listed in the reference section:
- 2VAA003700
- 8VZZ001882
- 9ARD171385-611
- 8VZZ001006T0001
- 2PAA121027
- 8VZZ000602
- 7PAA018617

General security recommendations

Purpose

What is the scope of the vulnerability?
- An attacker having access to the IEC 61850 network can force the ABB hardware devices to go to ‘fault’ state by sending a specially crafted 61850 packet. This will result in a denial-of-service situation affecting the primary functionality of the listed devices and requiring a manual reset. In the same way this vulnerability can cause the unavailability of the S+ Operations 61850 connectivity, if continued on a repeating basis (but not the whole S+ Operations node). The System 800xA IEC61850 Connect is not affected.

What causes the vulnerability?
- The vulnerability is caused by a weakness in the message processing in the IEC 61850 communication stack.

What is CI868?
- CI868 is a module used in AC800M product line (System 800xA) for IEC 61850 communication.

What is CI850?
- CI868 is a module used in Symphony Plus SD Series product line for IEC 61850 communication.

What is PM 877?
- PM 877 is a controller used in Symphony Plus MR (Melody Rack) product line for IEC 61850 communication.

What is S+ Operations?
- S+ Operations is the Human Machine Interface for supervision and control of Symphony based control or SCADA systems. It is a module used in AC800M product line (System 800xA) for IEC 61850 communication.

What might an attacker use the vulnerability to do?
- An attacker with access to IEC 61850 networks could exploit the vulnerability by sending a specially crafted 61850 packet to the S+ products, forcing the Communication Interfaces to fault modes or causing unavailability of the S+ Operations 61850 connectivity, resulting in a denial-of-service situation.

How could an attacker exploit the vulnerability?
- An attacker could try to exploit the vulnerability by creating a specially crafted message and sending the message to an affected system node. This would require that the attacker has access to the system network, by connecting to the network either directly or through a wrongly configured or penetrated firewall, or that he installs malicious software on a system node or otherwise infects the net-work with malicious software. Recommended practices help mitigate such attacks, see section Mitigating Factors.

Could the vulnerability be exploited remotely?
- Yes, an attacker who has network access to an affected system node could exploit this vulnerability. Recommended practices include that process control systems are physically protected, have no direct connections to the Internet, and are separated from other networks by means of a firewall system that has a minimal number of ports exposed.

Can functional safety be affected by an exploit of this vulnerability?
- Functional safety systems are not affected by these vulnerabilities.

What does the update do?
- The update removes the vulnerability by modifying the way that the IEC 61850 stack, used by the ABB Process Automation Products described above, manages 61850 incoming messages.

When this security advisory was issued, had this vulnerability been publicly disclosed?
- No, ABB received information about this vulnerability through responsible disclosure.

When this security advisory was issued, had ABB received any reports that this vulnerability was being exploited?
- No, ABB had not received any information indicating that this vulnerability had been exploited when this security advisory was originally issued.

Frequently Asked Questions

Summary: 2VAA003700 : S+ I/O: SD Series I/O: CI850 IEC 61850 Communication Module and Hardware Operation User Manual

Summary: 8VZZ001882 : S+ Control SPC600/700/800 SD Series controllers user manual

Summary: 9ARD171385-611 : System 800xA 6.1.1 AC 800M - IEC 61850 Configuration for CI868

Denial of Service Vulnerabilities in System 800xA, Symphony® Plus IEC 61850 communication stack

Summary: Initial version.

ABB

Firmware

ABB Firmware <=6.0.0303.0 (AC800M version 6.0.0-x) installed on ABB AC800M Product line (System 800xA) CI868 for IEC 61850 communication

ABB Firmware <=1.0031.0 (AC800M version 6.1.0-x) installed on ABB AC800M Product line (System 800xA) CI868 for IEC 61850 communication

ABB Firmware <=6.1.1004.0 AC800M version 6.1.1-0 and 6.1.1-1) installed on ABB AC800M Product line (System 800xA) CI868 for IEC 61850 communication

ABB Firmware <=6.1.1202.0 (AC800M version 6.1.1-2) installed on ABB AC800M Product line (System 800xA) CI868 for IEC 61850 communication

ABB Firmware <=6.2.0006.0 (AC800M version 6.2.0-0) installed on ABB AC800M Product line (System 800xA) CI868 for IEC 61850 communication

ABB Firmware A_0 installed on ABB Symphony Plus SD Series CI850 for IEC 61850 communication

ABB Firmware A_1 installed on ABB Symphony Plus SD Series CI850 for IEC 61850 communication

ABB Firmware A_2.003 installed on ABB Symphony Plus SD Series CI850 for IEC 61850 communication

ABB Firmware A_3.005 installed on ABB Symphony Plus SD Series CI850 for IEC 61850 communication

ABB Firmware A_4.001 installed on ABB Symphony Plus SD Series CI850 for IEC 61850 communication

ABB Firmware B_0.005 installed on ABB Symphony Plus SD Series CI850 for IEC 61850 communication

ABB Firmware >=3.10|<=3.52 installed on ABB Symphony Plus MR (Melody Rack)  PM 877 for IEC 61850 communication

ABB Firmware 3.3 and related service packs installed on ABB S+ Operations using IEC 61850 connectivity

ABB Firmware 2.3 installed on ABB S+ Operations using IEC 61850 connectivity

ABB Firmware 2.2 and related service packs installed on ABB S+ Operations using IEC 61850 connectivity

ABB Firmware 2.1 and related service packs installed on ABB S+ Operations using IEC 61850 connectivity

ABB Firmware 6.1.1-3 planned for Q2 2027 installed on ABB AC800M Product line (System 800xA) CI868 for IEC 61850 communication

ABB Firmware 7.0 released in Dec 2025 installed on ABB AC800M Product line (System 800xA) CI868 for IEC 61850 communication

ABB Firmware C_0 planned Q2 2026 installed on ABB Symphony Plus SD Series CI850 for IEC 61850 communication

ABB Firmware 3.53 (planned Q1 2026) installed on ABB Symphony Plus MR (Melody Rack)  PM 877 for IEC 61850 communication

ABB Firmware 3.4 (released in January 2026) installed on ABB S+ Operations using IEC 61850 connectivity

Improper Validation of Specified Quantity in Input

A vulnerability exists in the command handling of the IEC 61850 communication stack included in the product revisions listed above. An attacker with access to IEC 61850 networks could exploit the vulnerability by using a specially crafted 61850 packet, forcing the communication interfaces of the PM 877, CI850 and CI868 modules into fault mode or causing unavailability of the S+ Operations 61850 connectivity, resulting in a denial-of-service situation. The System 800xA IEC61850 Connect is not affected.

Note: This vulnerability does not impact on the overall availability and functionality of the S+ Operations node, only the 61850 communication function.

CVE description

Summary: NVD - CVE-2025-3756

ABB advises all customers to review their installations to determine if they are using an impacted product as listed above, no further analysis or tools are needed to make this determination.

The recommended immediate actions per product are listed below:
- CI868 (for AC 800M)
   Devices with firmware versions reported in Affected products are vulnerable. All the vulnerabilities will be corrected in 6.1.1  and 7.0 tracks for 800xA. AC 800M 6.1.1-3 is planned for Q2 2027, AC 800M 7.0 has been released in December 2025.
- CI850 (for Symphony Plus SD Series)
   Devices with firmware versions reported in Affected products are vulnerable. All the vulnerabilities will be corrected in version C_0 or later (planned Q2 2026).
- PM 877 (Symphony Plus MR)
   Devices with firmware versions reported in Affected products are vulnerable. All the vulnerabilities will be corrected with firmware version 3.53 or later (planned Q1 2026).
- S+ Operations
   Versions reported in Affected products are vulnerable. All the vulnerabilities will be corrected in version 3.4 or later (released in January 2026).

ABB recommends customers apply updates, as they become available, at their earliest convenience.  It is also advisable to review the Mitigating Factors, Workarounds and General security recommendations sections for additional actions which may help reduce overall risk.

The vulnerabilities announced in this Advisory for ABB Process Automation products require that an attacker has access to the system network and hosts which are generally expected to be protected.

Process Control and IEC 61850 networks are NOT recommended to be exposed directly to Internet connections. If these networks are not properly isolated, then connected components may be remotely exploitable as described in this advisory.

To exploit the vulnerability, an attacker with remote network access can send a specially crafted packet to the PM 877, CI850 and CI868 modules which causes the fault of these devices.

S+ Operations only implements 61850 client services and therefore are not intended to listen to in-coming connection requests. However, if a specially crafted message is sent anyway, it can still cause the 61850-communication driver to crash.

The usage of a perimeter firewall to allow legitimate client communications is an effective mitigation.

Refer to section “General security recommendations” for further advise on how to keep your system secure.

CVE-2025-3756


© Copyright 2025 ABB. All rights reserved.

ABB identified a critical vulnerability present in ABB Ability Edgenius starting from version 3.2.0.0. We have not received any reports of this vulnerability being exploited.

An unauthenticated attacker could exploit this vulnerability to:

→	install and run arbitrary code,

→	uninstall installed applications,

→	modify the configuration of installed applications,

on systems running the vulnerable versions of ABB Ability Edgenius, including 3.2.0.0 through 3.2.1.1.

Summary

Control systems and the control network are exposed to cyber threats. To minimize these risks, the protective measures and best practices listed below are available in addition to other measures. ABB strongly recommends system integrators and asset owners to implement the measures they consider appropriate for their control system environment:

–	Place control systems in a dedicated control network containing control systems only.

–	Locate control networks and systems behind firewalls and separate them from any other networks like business networks and the Internet.

–	Block any inbound Internet traffic destined for the control networks/systems. Place remote access systems used for remote control system access outside the control network.

–	Limit outbound Internet traffic originating from control systems/networks as much as possible. If control systems must talk to the Internet, tailor firewall rules to required resources - allow only source IPs, destination IPs and services/destination ports which control systems need to use for normal control operation.

–	If Internet access is required on occasion only, disable relevant firewall rules and enable them during the time window of required Internet access only. If supported by your firewall, define an expiry date and time for such rules – after the expiry date and time, the firewall will disable the rule automatically.

–	Limit exposure of control networks/systems to internal systems. Tailor firewall rules allowing traffic from internal systems to control networks/systems to allow only source IPs, destination IPs and services/destination ports which are definitely required for normal control operation.

–	Create strict firewall rules to filter malicious network traffic targeting control system vulnerabilities ("exploit traffic"). Exploit traffic may use network communication features like source routing, IP fragmentation and/or IP tunneling. If such features are not required for normal control operation, block them on your firewall.

–	If supported by your firewall, apply additional filters to allowed traffic which provide protection for control networks/systems. Such filters are provided by advanced firewall features like Application Control and Anti-Virus.

–	Use Intrusion Detection Systems (IDS) or Intrusion Preventions Systems (IPS) to detect/block control system-specific exploit traffic. Consider using IPS rules protecting against control system exploits.

–	When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Please ensure that VPN solutions are updated to the most current version available.

–	In case you want to filter internal control network traffic, consider using solutions supporting Intra-LAN traffic control like VLAN access control lists.

–	Harden your control systems by enabling only the ports, services and software required for normal control operation. Disable all other ports and disable/uninstall all other services and software.

–	If possible, limit the permissions of user accounts, software processes and devices to the permissions required for normal control operation.

–	Use trusted, patched software and malware protection solutions. Interact with trusted web sites and trusted email attachments only.

–	Ensure all nodes are always up to date in terms of installed software, operating system and firm-ware patches as well as anti-virus and firewall.

–	Protect control systems from physical access by unauthorized personnel e.g. by placing them in locked switch cabinets.

General security recommendations

Support

The information in this document is subject to change without notice, and should not be construed as a commitment by ABB.

ABB provides no warranty, express or implied, including warranties of merchantability and fitness for a particular purpose, for the information contained in this document, and assumes no responsibility for any errors that may appear in this document. In no event shall ABB or any of its suppliers be liable for direct, indirect, special, incidental or consequential damages of any nature or kind arising from the use of this document, or from the use of any hardware or software described in this document, even if ABB or its suppliers have been advised of the possibility of such damages.

This document and parts hereof must not be reproduced or copied without written permission from ABB, and the contents hereof must not be imparted to a third party nor used for any unauthorized purpose.

All rights to registrations and trademarks reside with their respective owners.

Notice

ABB has a rigorous internal cyber security continuous improvement process which involves regular testing with industry leading tools and periodic assessments to identify potential product issues. Occasionally an issue is determined to be a design or coding flaw with implications that may impact product cyber security.

When a potential product vulnerability is identified or reported, ABB immediately initiates our vulnerability handling process. This entails validating if the issue is in fact a product issue, identifying root causes, determining what related products may be impacted, developing a remediation, and notifying end users and governmental organizations (e.g. ICS-CERT).

The resulting Cyber Security Advisory intends to notify customers of the vulnerability and provide details on which products are impacted, how to mitigate the vulnerability or explain workarounds that minimize the potential risk as much as possible. The release of a Cyber Security Advisory should not be misconstrued as an affirmation or indication of an active threat or ongoing campaign targeting the products mentioned here. If ABB is aware of any specific threats, it will be clearly mentioned in the communication.

The publication of this Cyber Security Advisory is an example of ABB’s commitment to the user com-munity in support of this critical topic. Responsible disclosure is an important element in the chain of trust we work to maintain with our many customers. The release of an Advisory provides timely in-formation which is essential to help ensure our customers are fully informed.

Purpose

What is the scope of the vulnerability?

An attacker who successfully exploited this vulnerability could install and run arbitrary code, uninstall installed applications and modify the configuration of installed applications.

What causes the vulnerability?

The vulnerability is caused by an underlying API (Application Programming Interface) not adequately verifying authentication.

What is ABB Ability Edgenius Management Portal?

ABB Ability Edgenius Management Portal allows administrators to configure their edge and manage applications.

What might an attacker use the vulnerability to do?

An attacker who successfully exploited this vulnerability could be able to run arbitrary code on the edge and modify the configuration of installed applications.

How could an attacker exploit the vulnerability?

An attacker could try to exploit the vulnerability by creating a specially crafted message and sending the message to an affected system node. This would require that the attacker has access to the system network, by connecting to the network either directly or through a wrongly configured or penetrated firewall, or that he installs malicious software on a system node or otherwise infects the net-work with malicious software. Recommended practices help mitigate such attacks, see section Miti-gating Factors above.

Could the vulnerability be exploited remotely?

Yes, an attacker who has network access to an affected system node could exploit this vulnerability. Recommended practices include that process control systems are physically protected, have no direct connections to the Internet, and are separated from other networks by means of a firewall system that has a minimal number of ports exposed.

What does the update do?

The update removes the vulnerability, ensuring that the vulnerable parts of the Edgenius Management Portal validate authorization for requests.
Meanwhile please refer to the defined mitigations and workaround.

When this security advisory was issued, had this vulnerability been publicly disclosed?

No, ABB discovered this vulnerability through internal testing.

When this security advisory was issued, had ABB received any reports that this vulnerability was being exploited?

No, ABB had not received any information indicating that this vulnerability had been exploited when this security advisory was originally issued

Frequently Asked Questions

Summary: ABB CYBERSECURITY ADVISORY - PDF version

Summary: ABB CYBERSECURITY ADVISORY - CSAF version

Summary: 7PAA022086_en	CVE-2025-10571 Workaround Instructions

Edgenius Management Portal Authentication Bypass

Summary: Initial version.

Authentication Bypass Using an Alternate Path or Channel

The Edgenius Management Portal in the affected product versions contains a vulnerability that allows authentication to be bypassed. An attacker could exploit the vulnerability by sending a specially craft-ed message to the system node allowing the attacker to install and run arbitrary code, uninstall in-stalled applications and modify the configuration of installed applications.

CVE description

Summary: NVD - CVE-2025-10571

ABB has prepared an update to fix this vulnerability included in the latest Roll-Up, ABB Ability Edgenius version 3.2.2.0.

ABB advises customers to upgrade as soon as possible. Until the upgrade is applied, ABB advises customers to disable the Edgenius Management Portal to mitigate the vulnerability.

Exploitation requires an attacker to have gained access to the network where Edgenius has been deployed, and while the Edgenius Management Portal is running.

Refer to section “General security recommendations” for further advise on how to keep your system secure.

Workarounds are specific measures that a user can take to help block an attack, for example, temporarily disabling the vulnerable feature may remove the exposure with well-known impact on functionality. ABB has tested the following workaround.

CVE-2025-10571


ABB is aware of public reports of vulnerabilities in 7-Zip version 18.5 and Microsoft Azure Data Studio version 1.32 included in the product versions listed as affected in the advisory.

The vulnerability in 7-Zip can be exploited if attacker gains control over the system and extracts a malicious file using this version of 7-Zip. Otherwise, the attacker must force the user to visit malicious websites or click links and extract the package through 7-zip.

Microsoft Azure Data Studio gets installed along with SQL Server Management Studio. An attacker who successfully exploits vulnerability in Microsoft Azure Data studio may compromise the security of the product by gaining privileges, reading sensitive information, executing commands, evading detection, etc. if the Authentication, Authorization and Accountability is not configured properly in the system. However, none of the products listed above uses Microsoft Azure Data Studio. Microsoft Azure Data Studio is automatically removed from the system from System 800xA 7.0 onwards.

These vulnerabilities may appear when the product media is scanned. However, they can only be ex-ploited if the vulnerable software is installed on the system. For this reason, it is strongly advised to uninstall outdated or vulnerable versions of third-party software immediately.

Summary

For additional instructions and support please contact your local ABB service organization. For contact information, see www.abb.com/contactcenters.

Information about ABB’s cyber security program and capabilities can be found at www.abb.com/cybersecurity.

Support

Notice

Control systems and the control network are exposed to cyber threats. To minimize these risks, the protective measures and best practices listed below are available in addition to other measures. ABB strongly recommends system integrators and asset owners to implement the measures they consider appropriate for their control system environment:

- Place control systems in a dedicated control network containing control systems only.
- Locate control networks and systems behind firewalls and separate them from any other networks like business networks and the Internet.
- Block any inbound Internet traffic destined for the control networks/systems. Place remote access systems used for remote control system access outside the control network.
- Limit outbound Internet traffic originating from control systems/networks as much as possible. If control systems must talk to the Internet, tailor firewall rules to required resources - allow only source IPs, destination IPs and services/destination ports which control systems need to use for normal control operation.
- If Internet access is required on occasion only, disable relevant firewall rules and enable them during the time window of required Internet access only. If supported by your firewall, define an expiry date and time for such rules – after the expiry date and time, the firewall will disable the rule automatically.
- Limit exposure of control networks/systems to internal systems. Tailor firewall rules allowing traffic from internal systems to control networks/systems to allow only source IPs, destination IPs and services/destination ports which are definitely required for normal control operation.
- Create strict firewall rules to filter malicious network traffic targeting control system vulnerabilities ("exploit traffic"). Exploit traffic may use network communication features like source routing, IP fragmentation and/or IP tunneling. If such features are not required for normal control operation, block them on your firewall.
- If supported by your firewall, apply additional filters to allowed traffic which provide protection for control networks/systems. Such filters are provided by advanced firewall features like Application Control and Anti-Virus.
- Use Intrusion Detection Systems (IDS) or Intrusion Preventions Systems (IPS) to detect/block control system-specific exploit traffic. Consider using IPS rules protecting against control system exploits.
- When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Please ensure that VPN solutions are updated to the most current version available.
- In case you want to filter internal control network traffic, consider using solutions supporting Intra LAN traffic control like VLAN access control lists.
- Harden your control systems by enabling only the ports, services and software required for normal control operation. Disable all other ports and disable/uninstall all other services and software.
- If possible, limit the permissions of user accounts, software processes and devices to the permissions required for normal control operation.
- Use trusted, patched software and malware protection solutions. Interact with trusted web sites and trusted email attachments only.
- Ensure all nodes are always up to date in terms of installed software, operating system and firmware patches as well as anti-virus and firewall.
- Protect control systems from physical access by unauthorized personnel e.g. by placing them in locked switch cabinets.

For more information on recommended practices, please refer to the following documents listed in the reference section:
- 3BDS011222D
- 3BSE034463D
- 3BSE037410D
- 3BSE080520D

General security recommendations

ABB has a rigorous internal cyber security continuous improvement process which involves regular testing with industry leading tools and periodic assessments to identify potential product issues. Occasionally an issue is determined to be a design or coding flaw with implications that may impact product cyber security.

When a potential product vulnerability is identified or reported, ABB immediately initiates our vulnerability handling process. This entails validating if the issue is in fact a product issue, identifying root causes, determining what related products may be impacted, developing a remediation, and notifying end users and governmental organizations (e.g. ICS-CERT).

The resulting Cyber Security Advisory intends to notify customers of the vulnerability and provide details on which products are impacted, how to mitigate the vulnerability or explain workarounds that minimize the potential risk as much as possible. The release of a Cyber Security Advisory should not be misconstrued as an affirmation or indication of an active threat or ongoing campaign targeting the products mentioned here. If ABB is aware of any specific threats, it will be clearly mentioned in the communication.

The publication of this Cyber Security Advisory is an example of ABB’s commitment to the user community in support of this critical topic. Responsible disclosure is an important element in the chain of trust we work to maintain with our many customers. The release of an Advisory provides timely information which is essential to help ensure our customers are fully informed.

Purpose

What is the scope of the vulnerability?
- An attacker who successfully exploited 7-Zip vulnerabilities could plant malicious files outside the extraction directories potentially compromising the full system.

   An attacker who successfully exploited Microsoft Azure Data Studio vulnerability could allow a local attacker with low-level privileges to escalate their access potentially gaining full control over the sys-tem by exploiting improper access control. The exploitability of this vulnerability is rated as less likely by Microsoft (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-26203).

What causes the vulnerability?
- The vulnerability is caused by presence of vulnerable versions of the third-party software (7-Zip and Microsoft Azure Data Studio).

Why is it recommended to remove third-party software instead of updating it to a newer version without known vulnerabilities?
- The vulnerable third-party software is recommended for removal rather than updating because these applications are not required for the functioning of the mentioned products. Retaining unused soft-ware on a system is generally considered poor practice, as it can introduce unnecessary risks and maintenance overhead. Therefore, removal is advised to maintain a clean and secure environment. However, if a user chooses to keep such software installed, the responsibility for updating and maintaining it lies entirely with the user.

What is ABB 800xA History?
- 800xA History is the main Historian Component which seamlessly stores real time-data (process values, events) from the control system and processes the data as per user requirement and makes it available for further analysis.

What is ABB Batch Management?
- Batch Management is powerful, flexible software used to configure, run, and manage Batch operations.

What is ABB Production Response History?
- Production Response (PR) provides the functions for collecting, Storing, maintaining, viewing, and analyzing Batch Management Production Data.

What is ABB 800xA for Symphony Plus Harmony?
- 800xA for Symphony Plus Harmony provides connectivity to the Symphony Plus Distributed Control System (DCS). This connectivity is integrated with the 800xA Operator Workplace to provide a single  operation and configuration view of the system.

What is ABB 800xA for AC 870P Melody?
- The 800xA for AC 870P / Melody component connects the Control System AC 870P / Melody and 800xA Operations to a System 800xA distributed process management and control system.

What is ABB Application Change Management?
- Application Change Management (ACM) is a version control tool used for engineering solutions in System 800xA. It is a configuration management system designed to handle configuration records. It also has the capability to be used as a configuration change reporting system.

What might an attacker use the vulnerability to do?
- An attacker who successfully exploits 7-Zip vulnerabilities could plant malicious files outside the extraction directories potentially compromising the full system.
   An attacker who successfully exploits Microsoft Azure Data Studio vulnerability allows a local attacker with low-level privileges to escalate their access, potentially gaining full control over the system by       exploiting improper access control.

How could an attacker exploit the vulnerability?
- An attacker could try to exploit vulnerability, by gaining control over the system and extracts a malicious file using this version of 7-Zip. Otherwise, the attacker must force the user to visit malicious websites or click links and extract the package through 7-zip.

   Similarly Azure Data Studio improperly handles privileged commands. An attacker can abuse this gap to run malicious code with higher privileges.

   Recommended practices help mitigate such attacks, see section Mitigating Factors above.

Could vulnerability be exploited remotely?
- Yes, an attacker who has network access to an affected system node could exploit this vulnerability. Recommended practices include that process control systems are physically protected, have no direct connections to the Internet, and are separated from other networks by means of a firewall system that has a minimal number of ports exposed.

Can functional safety be affected by an exploit of this vulnerability?
- No

What does the update do?
- This is not an update. It is a recommendation to the customer to uninstall the vulnerable version of the software.

When this security advisory was issued, had this vulnerability been publicly disclosed?
- Yes, this vulnerability in the third-party software has been publicly disclosed.

When this security advisory was issued, had ABB received any reports that this vulnerability was being exploited?
- No, ABB had not received any information indicating that this vulnerability had been exploited in 800xA Systems, when this security advisory was originally issued.

Frequently Asked Questions

Summary: ABB CYBERSECURITY ADVISORY - PDF Version

Summary: ABB CYBERSECURITY ADVISORY - CSAF Version

Summary: 3BDS011222D	: System 800xA Reference - System Configuration

Summary: 3BSE034463D	: System 800xA Reference - Network Configuration

Summary: 3BSE037410D : System 800xA Reference - Administration and Security

Summary: 3BSE080520D : System 800xA Reference - Security Deployment Guide

System 800xA affected by 3rd party component vulnerabilities

Summary: Initial version.

ABB

800xA for Symphony Plus Harmony

ABB 800xA for Symphony Plus Harmony <=6.2

Production Response Batch History

ABB Production Response Batch History <=6.2

Improper Link Resolution Before File Access ('Link Following')

7-Zip before does not always properly handle symbolic links during extraction.

CVE description

Summary: NVD - CVE-2025-55188

Workarounds are specific measures that a user can take to help block an attack, for example, temporarily disabling the vulnerable feature may remove the exposure with well-known impact on functionality.

There are no workarounds. Uninstalling the affected third-party software fully eliminates the risk of vulnerabilities. Refer to the section ‘Recommended immediate actions’.

ABB recommends uninstalling the version of 7-Zip and Microsoft Azure Data Studio from the system. Uninstallation does not affect the functionality of the products.

ABB recommends that customers perform the uninstallation at earliest convenience.

Refer to section “General security recommendations” for further advise on how to keep your system secure.

7-Zip – An attacker needs to extract the file with the vulnerable version of 7-Zip or trick a user to click a link or download a malicious file and extract them.

Microsoft Azure Data Studio – An attacker needs to get into the system and open a malicious file or run code which could exploit this vulnerability.

In both scenarios, the attack will be less likely if the user has configured the system as per recommended guidelines.

CVE-2025-55188

7-Zip is a file archiver with a high compression ratio. 7-Zip supports extracting from Compound Documents.

CVE description

Summary: NVD - CVE-2025-53817

CVE-2025-53817

7-Zip is a file archiver with a high compression ratio. Zeroes written outside heap buffer in RAR5 handler may lead to memory corruption and denial of service in versions of 7-Zip.

CVE description

Summary: NVD - CVE-2025-53816

CVE-2025-53816

This vulnerability allows remote attackers to execute arbitrary code on affected installations of 7-Zip. Crafted data in a ZIP file can cause the process to traverse to unintended directories.

CVE description

Summary: NVD - CVE-2025-11002

CVE-2025-11002

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE description

Summary: NVD - CVE-2025-11001

CVE-2025-11001

This vulnerability allows remote attackers to bypass the Mark-of-the-Web protection mechanism on affected installations of 7-Zip. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

CVE description

Summary: NVD - CVE-2025-0411

CVE-2025-0411

Loop with Unreachable Exit Condition ('Infinite Loop')

This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of 7-Zip.

CVE description

Summary: NVD - CVE-2024-11612

CVE-2024-11612

This vulnerability allows remote attackers to execute arbitrary code on affected installations of 7-Zip. Interaction with this library is required to exploit this vulnerability

CVE description

Summary: NVD - CVE-2024-11477

CVE-2024-11477

The NtfsHandler.cpp NTFS handler in 7-Zip before 24.01 (for 7zz) contains an out-of-bounds read that allows an attacker to read beyond the intended buffer. The bytes read beyond the intended buffer are presented as a part of a filename listed in the file system image.

CVE description

Summary: NVD - CVE-2023-52169

CVE-2023-52169

The NtfsHandler.cpp NTFS handler in 7-Zip before 24.01 (for 7zz) contains a heap-based buffer overflow that allows an attacker to overwrite two bytes at multiple offsets beyond the allocated buffer size: buffer+512*i-2, for i=9, i=10, i=11, etc.

CVE description

Summary: NVD - CVE-2023-52168

CVE-2023-52168

This vulnerability allows remote attackers to execute arbitrary code on affected installations of 7-Zip. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

CVE description

Summary: NVD - CVE-2023-40481

CVE-2023-40481

Ppmd7.c in 7-Zip before 23.00 allows an integer underflow and invalid read operation via a crafted 7Z archive.

CVE description

Summary: NVD - CVE-2023-31102

CVE-2023-31102

Improper Check for Unusual or Exceptional Conditions

7-Zip does not report an error for certain invalid xz files, involving stream flags and reserved bits.

CVE description

Summary: NVD - CVE-2022-47112

CVE-2022-47112

7-Zip 22.01 does not report an error for certain invalid xz files, involving block flags and reserved bits. Some later versions are unaffected.

CVE description

Summary: NVD - CVE-2022-47111

CVE-2022-47111

7-Zip through 21.07 on Windows allows privilege escalation and command execution when a file with the .7z extension is dragged to the Help>Contents area. This is caused by misconfiguration of 7z.dll and a heap overflow. The command runs in a child process under the 7zFM.exe process.

CVE description

Summary: NVD - CVE-2022-29072

CVE-2022-29072

CVE description

Summary: NVD - CVE-2024-26203

CVE-2024-26203


An update is available that resolves vulnerability in the product versions as affected in this advisory.
An attacker who successfully exploits the vulnerability could get unauthorized access to the file system
on the host machine. This can lead to the execution of arbitrary code, data leakage, or even complete
system compromise.

Summary

For any installation of software-related ABB products we strongly recommend the following (non-exhaustive) list of cyber security practices:
Isolate special purpose networks (e.g. for automation systems) and remote devices behind firewalls and
separate them from any general-purpose network (e.g. office or home networks).
Install physical controls so no unauthorized personnel can access your devices, components, peripheral
equipment, and networks.
Never connect programming software or computers containing programing software to any net-work
other than the network for the devices that it is intended for.
Scan all data imported into your environment before use to detect potential malware infections.
Minimize network exposure for all applications and endpoints to ensure that they are not accessible
from the Internet unless they are designed for such exposure and the intended use requires such.
Ensure all nodes are always up to date in terms of installed software, operating system, and firmware
patches as well as anti-virus and firewall.
When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available.
Also, understand that VPNs are only as secure as the connected devices.
More information on recommended practices can be found in the reference section (3AXD10000492137)

General security recommendations

For additional instructions and support please contact your local ABB service organization. For contact
information, see www.abb.com/contactcenters.
Information about ABB’s cyber security program and capabilities can be found at www.abb.com/cybersecurity.

Support

The information in this document is subject to change without notice, and should not be construed as a
commitment by ABB.
ABB provides no warranty, express or implied, including warranties of merchantability and fitness for a
particular purpose, for the information contained in this document, and assumes no responsibility for
any errors that may appear in this document. In no event shall ABB or any of its suppliers be liable for direct, indirect, special, incidental or consequential damages of any nature or kind arising from the use of
this document, or from the use of any hardware or software described in this document, even if ABB or
its suppliers have been advised of the possibility of such damages.
This document and parts hereof must not be reproduced or copied without written permission from
ABB, and the contents hereof must not be imparted to a third party nor used for any unauthorized purpose.
All rights to registrations and trademarks reside with their respective owners.

Notice

The identified vulnerability could be exploited when a user opens a tampered Drive Composer file (such
as a support package or parameter backup). Users are advised to only open Drive Composer files received from trusted sources and ensure they are free from any alterations by scanning the files through
a malware scanner.
Refer to section “General security recommendations” for further advise on how to keep your system secure.

Mitigating factors

Summary: Directory Traversal vulnerability in DotNetZip

Summary: Technical Guide - Cybersecurity for ABB Drives (3AXD10000492137)

Drive Composer Path Traversal Vulnerability

Summary: Initial version

Summary: Formatting improvement

Summary: CVE number typographical error correction

Vulnerability in drive composer can allow attackers unauthorized access to the file system on the host
machine. An attacker can exploit this flaw to run malicious code, which could lead to the compromise of
the affected system.

CVE Description

Summary: NVD - CVE-2024-48510

The vulnerability mentioned in this advisory has been corrected in Drive Composer version 2.9.1.
Drive Composer version 2.9.1 (both entry and pro) is downloadable from the product page:
https://new.abb.com/drives/software-tools/drive-composer
ABB recommends that customers apply the update at earliest convenience.

CVE-2024-48510


Summary: reporting the vulnerabilities through responsible disclosure

An update is available that resolves a privately reported vulnerability in the product versions listed as affected in this advisory.

FLXEON devices are not intended to be internet-facing. A product advisory issued in June 2023 informed customers of this parameter.

An attacker can successfully exploit these vulnerabilities and could take remote control of the product and potentially insert and run arbitrary code.
ABB requires, as noted in previous security advisories and user documentation, that FLXEON should not be exposed to the internet or any other insecure network.
Note: In order to exploit an FLXEON, an attacker would need a misconfigured system.

ABB strongly advises customers and system integrators to follow the instructions documented in: FBXi, CBXi and ASPECT® SOLUTIONS, which can be downloaded from the ABB library (See in the reference section).

Summary

For any installation of software-related ABB products and especially for products in scope of the FLXEON product line, we strongly recommend the following (non-exhaustive) list of cyber security practices:
•	Ensure that all FLXEON products are upgraded to the latest firmware version. Please find the latest version of FLXEON firmware on the respective product homepage
•	Isolate special purpose networks (e.g. for automation systems) and remote devices behind firewalls and separate them from any general-purpose network (e.g. office or home networks).
•	Install physical controls so no unauthorized personnel can access your devices, components, peripheral equipment, and networks.
•	Never connect programming software or computers containing programming software to any network other than the network for the devices that it is intended for.
•	Scan all data imported into your environment before use to detect potential malware infections.
•	Minimize network exposure for all FLXEON ports and endpoints to ensure that they are not accessible directly from the Internet.
•	Ensure all nodes are always up to date in terms of installed software, operating system, and firmware patches as well as anti-virus and firewall.
•	When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available
More information on recommended practices can be found in the following documents: FBXi, CBXi and ASPECT® SOLUTIONS ((HT0038)

General security recommendations

For additional instructions and support please contact your local ABB service organization. For contact information, see www.abb.com/contactcenters.

Information about ABB’s cyber security program and capabilities can be found at www.abb.com/cybersecurity.

Support

The information in this document is subject to change without notice, and should not be construed as a commitment by ABB.
ABB provides no warranty, express or implied, including warranties of merchantability and fitness for a particular purpose, for the information contained in this document, and assumes no responsibility for any errors that may appear in this document. In no event shall ABB or any of its suppliers be liable for direct, indirect, special, incidental or consequential damages of any nature or kind arising from the use of this document, or from the use of any hardware or software described in this document, even if ABB or its suppliers have been advised of the possibility of such damages.
This document and parts hereof must not be reproduced or copied without written permission from ABB, and the contents hereof must not be imparted to a third party nor used for any unauthorized purpose.
All rights to registrations and trademarks reside with their respective owners.

Notice

Users accessing FLXEON remotely shall do this using a VPN Gateway allowing access to the particular network segment where FLXEON is installed and configured.
Note: it is crucial that the VPN Gateway and Network is setup in accordance with best industry standards and maintained in terms of security patches for all related components.

Workarounds

The vulnerabilities reported in scope of this document are only exploitable if attackers can access the network segment where FLXEON is installed and exposed directly to the internet. ABB therefore recommends the following guidelines in order to protect customers networks:
•	FLXEON devices should never be exposed directly to the Internet either via a direct ISP connection nor via NAT port forwarding. If remote access to a FLXEON system is a customer requirement, the system shall operate behind a firewall. Users accessing FLXEON remotely shall do this using a VPN Gateway allowing access to the particular network segment where FLXEON is installed and configured.
•	Note: it is crucial that the VPN Gateway and Network is setup in accordance with best industry standards and maintained in terms of security patches for all related components.
•	ABB System Integrators shall change default passwords if they are still in use.
•	Ensure that all FLXEON products are upgraded to the latest firmware version. Please find the latest version of FLXEON firmware on the respective product homepage

Mitigating factors

Summary: FBXi, CBXi and ASPECT® SOLUTIONS (HT0038)

FLXeon Controllers Cyber Security Advisory

Summary: Initial version

Summary: Fixing file name

Summary: Fixing page formatting

Summary: CVE-2024-48841, corrected severity

Summary: Resolved minor fixes.

Summary: Fix copyright year and CVSS value

Summary: CWE value and description corrected

Improper Neutralization of Special Elements used in a Command ('Command Injection')

Network access can be used to execute arbitrary code with elevated privileges. This issue affects FLXEON <=9.3.4

CVE description

Summary: NVD -CVE-2024-48841

-	Stop and disconnect any FLXEON products that are exposed directly to the Internet, either via a direct ISP connection or via NAT port forwarding
-	Ensure that physical controls are in place, so no unauthorized personnel can access your devices, components, peripheral equipment, and networks
-	Ensure that all FLXEON products are upgraded to the latest firmware version (9.3.5 or above). Please find the latest version of FLXEON firmware on the respective product homepage
-	When remote access is required, only use secure methods.  If a Virtual Private Network (VPN) is used, ensure that the chosen VPN is secure i.e. updated to the most current version available and configured for se-cure access.

CVE-2024-48841

Session management was not sufficient to prevent unauthorized HTTPS requests. This issue affects FLXEON<= 9.3.4

CVE description

Summary: NVD -CVE-2024-48849

CVE-2024-48849

Insertion of Sensitive Information into Log File

Some information may be improperly disclosed through https access.  This issue affects FLXEON<= 9.3.4

CVE description

Summary: NVD -CVE-2024-48852

CVE-2024-48852