Summary: reporting the vulnerabilities through responsible disclosure.

© Copyright 2025 ABB. All rights reserved.

ABB became aware of vulnerabilities in the product versions listed as affected in the advisory. ASPECT devices are not intended to be internet-facing. A product advisory issued in June 2023 informed customers of this already.
An attacker who successfully exploits these vulnerabilities could gain unauthorized access and potentially compromise the system's - and log-file -  confidentiality, integrity and availability.
ABB requires, as noted in previous security advisories and user documentation, that ASPECT should not be exposed to the internet or any other insecure network.
Note: In order to exploit an ASPECT, an attacker would need a misconfigured system.
ABB strongly advises customers and system integrators to follow the instructions documented in: FBXi, CBXi and ASPECT® SOLUTIONS, which can be downloaded from the ABB library.

Summary

For any installation of software-related ABB products and especially for products in scope of the ASPECT product line, we strongly recommend the following (non-exhaustive) list of cyber security practices:
•	Ensure that all ASPECT products are upgraded to the latest firmware version. Please find the latest version of ASPECT firmware on the respective product homepage

•	Isolate special purpose networks (e.g. for automation systems) and remote devices behind firewalls and separate them from any general-purpose network (e.g. office or home networks).

•	Install physical controls so no unauthorized personnel can access your devices, components, peripheral equipment, and networks.

•	Never connect programming software or computers containing programming software to any network other than the network for the devices that it is intended for.

•	Scan all data imported into your environment before use to detect potential malware infections.

•	Minimize network exposure for all ASPECT ports and endpoints to ensure that they are not accessible directly from the Internet.

•	Ensure all nodes are always up to date in terms of installed software, operating system, and firmware patches as well as anti-virus and firewall.

•	When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available.

•	Authorized users shall change all default credentials during commissioning of an ASPECT system. If credentials have not been changed during commission state, ABB advises to change each changeable credential at the earliest.

General security recommendations

For additional instructions and support please contact your local ABB service organization. For contact information, see www.abb.com/contactcenters.
Information about ABB’s cyber security program and capabilities can be found at www.abb.com/cybersecurity

Support

Notice

Users accessing ASPECT remotely shall do this using a VPN Gateway allowing access to the particular network segment where ASPECT is installed and configured.
Note: it is crucial that the VPN Gateway and Network is setup in accordance with best industry standards and maintained in terms of security patches for all related components.

Workarounds

The vulnerabilities reported in scope of this document are only exploitable if attackers can access the network segment where ASPECT is installed and exposed directly to the internet. ABB therefore recommends the following guidelines in order to protect customer networks:

•	ASPECT devices should never be exposed directly to the Internet either via a direct ISP connection nor via NAT port forwarding. If remote access to an ASPECT system is a customer requirement, the system shall operate behind a firewall. Users accessing ASPECT remotely shall do this using a VPN Gateway allowing access to the particular network segment where ASPECT is installed and configured.

•	Note: it is crucial that the VPN Gateway and Network is setup in accordance with best industry standards and maintained in terms of security patches for all related components.

•	ABB System Integrators shall change default passwords if they are still in use.
•	Ensure that all ASPECT products are upgraded to the latest firmware version. Please find the latest version of ASPECT firmware on the respective product homepage

Mitigating factors

Summary:
ABB strongly advises customers and system integrators to follow the instructions documented in: FBXi, CBXi and ASPECT® SOLUTIONS, which can be downloaded from the ABB library.
  {HT0038}

Hardcoded credentials in ASPECT Energy Management System

Summary: Initial version.

Summary: Added link to CVE on NVD and concretized the vulnerability description.

Several hard-coded credentials for product internal use are contained in the firmware as plain text information.

CVE description

Summary: NVD - CVE-2024-51547

Please immediately do the following actions on any released SW version of ASPECT:
-	Stop and disconnect any ASPECT products that are exposed directly to the Internet, either via a direct ISP connection or via NAT port forwarding.
-	Ensure that physical controls are in place, so no unauthorized personnel can access your devices, components, peripheral equipment, and networks.
-	Ensure log-files, downloaded from the equipment is protected against unauthorized access.
-	Ensure that all ASPECT products are upgraded to the latest firmware version. Please find the latest version of ASPECT firmware on the respective product homepage.
-	When remote access is required, only use secure methods.  If a Virtual Private Network (VPN) is used, ensure that the chosen VPN is secure i.e. updated to the most current version available and configured for secure access.

CVE-2024-51547


An update is available that resolves a vulnerability in the product versions listed as affected in this advisory.
An attacker who successfully exploited this vulnerability could cause the web UI to stop.

Summary

The information in this document is subject to change without notice, and should not be construed as a commitment by ABB.
ABB provides no warranty, express or implied, including warranties of merchantability and fitness for a particular purpose, for the information contained in this document, and assumes no responsibility for any errors that may appear in this document. In no event shall ABB or any of its suppliers be liable for direct, indirect, special, incidental or consequential damages of any nature or kind arising from the use of this document, or from the use of any hardware or software described in this document, even if ABB or its suppliers have been advised of the possibility of such damages.
This document and parts hereof must not be reproduced or copied without written permission from ABB, and the contents hereof must not be imparted to a third party nor used for any unauthorized purpose.
All rights to registrations and trademarks reside with their respective owners.

Notice

The vulnerability is only present when the REST interface is enabled.  Only enable the REST interface when needed for the configuration of MQTT. Ensure that the REST interface is disabled after finishing configuring MQTT utilities.

Workarounds

For any installation of software-related ABB products, we strongly recommend the following (non-exhaustive) list of cyber security practices:
Isolate special purpose networks (e.g., for automation systems) and remote devices behind firewalls and separate them from any general-purpose network (e.g., office or home networks).
Install physical controls so no unauthorized personnel can access your devices, components, peripheral equipment, and networks.
Never connect programming software or computers containing programming software to any network other than the network for the devices that it is intended for.
Scan all data imported into your environment before use to detect potential malware infections.
Minimize network exposure for all applications and endpoints to ensure that they are not accessible from the Internet unless they are designed for such exposure and the intended use requires such.
Ensure all nodes are always up to date in terms of installed software, operating system, and firmware patches as well as anti-virus and firewall.
When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.

General security recommendations

For additional instructions and support please contact your local ABB service organization. For contact information, see www.abb.com/contactcenters.
Information about ABB’s cyber security program and capabilities can be found at www.abb.com/cybersecurity.

Support

ABB recommends disabling the REST interface when not being used to configure the MQTT functionality. By default, the REST interface is disabled so no risk is present.
The RMC-100 is not intended for access over public networks such as the internet. An attacker would need to have access to the customer’s private control network to exploit this vulnerability. Proper network segmentation is recommended.
Refer to section “General security recommendations” for further advise on how to keep your system secure.

Mitigating factors

Summary: ABB CYBERSECURITY ADVISORY - PDF version

Summary: ABB CYBERSECURITY ADVISORY - CSAF version

RMC-100 Vulnerability in the Web UI (REST Interface)

Summary: Initial

ABB

RMC-100 LITE

RMC-100 LITE Customer Package 2106260-017

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

A vulnerability exists in the web UI (REST interface) included in the product versions listed above. An attacker could exploit the vulnerability by sending a specially crafted message to the web UI node, causing a Node process hang, requiring restart of the REST interface (disable/enable).

CVE Description

Summary: NVD CVE-2022-24999

The problem is corrected in the following product versions:

RMC-100 Customer Package (2105452-048).
RMC-100 LITE Customer Package (2106260-017).

ABB recommends that customers apply the update at earliest convenience. Please find these updates here: RMC - Flow Computers (Flow Computers, Remote Controllers and RTUs) | Flow Computers | ABB

CVE-2022-24999


Summary: reporting the vulnerabilities in responsible disclosure.

ABB became aware of vulnerabilities in IPGW product versions listed as affected in the advisory. An attacker who successfully exploits these vulnerabilities could potentially gain unauthorized access and potentially compromise the system's - and log-file - confidentiality, integrity and availability.
ABB requires that the IP-address of an IPGW should not be accessible from the Internet  or any other network considered insecure. The communication between IPGW and the associated Internet Service shall be outbound-initiated, bi-directional. Any unsolicited inbound connection shall be discarded. A common way to ensure this best practice is to operate IPGW behind a firewall.
Researchers have reported 2518 CVEs to ABB which were identified using an automated scanning tool in a local network. ABB has analyzed these CVEs carefully and came to the following result:

2074 - CVE's not impacting IPGW because it belongs to SW components inside the IPGW-Firmware-Image, that are not supported by the IPGW as a product, e.g. IPGW does not support: Display, USB-port, Keyboard, etc.

7 - High Severity CVEs that belong to SW components integrated in IPGW-firmware-image.  These CVE’s are considered to have a high severity because there are proof of concept (PoC) descriptions available.
For cases that are not fixed, ABB was not able to find an appropriate solution.

34 - Medium CVEs that belong to SW components integrated in IPGW-firmware-image.  ABB defines a medium severity for CVE’s where there is no PoC available describing how to exploit such CVE and where the CVE belongs to a SW-Component as part of the IPGW-firmware-image, that is frequently used. For cases that are not fixed, ABB was not able to find an appropriate solution.

403 - Low severity CVEs that belong to SW components integrated in IPGW-firmware-image. ABB defines a low severity for CVE’s where there is no PoC available describing how to exploit such CVE and where criticality is seen low. ABB will monitor these CVE’s internally

Summary

For any installation of software-related ABB products and especially for products in scope of the IPGW product line, we strongly recommend the following (non-exhaustive) list of cyber security practices:
•	Ensure that all IPGW products are upgraded to the latest firmware version. Please find the latest version of IPGW firmware on the respective product homepage.
•	Isolate special purpose networks (e.g. for automation systems) and remote devices behind firewalls and separate them from any general-purpose network (e.g. office or home networks) wherever possible.
•	Install physical controls to prevent unauthorized personnel can access your devices, components, peripheral equipment, and networks.
•	Never connect programming software or computers containing programing software to any network other than the network for the devices that it is intended for.
•	Scan all data imported into your environment before use to detect potential malware infections.
•	Minimize network exposure for all IPGW ports and endpoints to ensure that they are not accessible directly from the Internet.
•	Ensure all nodes of your internal network are always up to date in terms of installed software, operating system, and firmware patches as well as anti-virus and firewall.
•	Authorized users shall change all default credentials during commissioning of an IPGW system. If credentials have not been changed during commission state, ABB advises to change each changeable credential at the earliest.
•	Please note: Remote access is supported exclusively by using ABB services such as my.busch-jaeger.de or mybuildings.abb.com. Other means of remote access violate the ABB specification of compliant product operation and the intended use of the product.

General security recommendations

Support

Notice

The vulnerabilities reported in scope of this document are only exploitable if attackers can access the network segment where IPGW is installed and exposed directly to the internet. ABB therefore recommends the following guidelines in order to protect customers networks:
•	Remote access is supported exclusively by using ABB services such as my.busch-jaeger.de or mybuildings.abb.com. Other means of remote access violate the ABB specification of compliant product operation and the intended use of the product
•	IPGW devices should never be exposed directly to the Internet either via a direct ISP connection nor via NAT port forwarding
•	Authorized users shall change all default credentials during commissioning of an IPGW system. If credentials have not been changed during commission state, ABB advises to change each changeable credential at the earliest
•	Ensure that all IPGW products are upgraded to the latest firmware version. Please find the latest version of IPGW firmware on the respective product homepage

Mitigating factors

Using the IPGW exclusively within the local Network is also possible. In this case no Internet service is required at all. The IPGW’s IP-address must be protected against access over the Internet or other networks considered unsecure, by means of a firewall, NAT Router or similar.
NOTE: Remote access is supported exclusively by using ABB services such as my.busch-jaeger.de or mybuildings.abb.com. Other means of remote access violate the ABB specification of compliant product operation and the intended use of the product

Workarounds

ELSB/Home Solutions Outdated SW Components in ABB Welcome IP-Gateway.

Summary: Initial version

Summary: Version update

ABB

Welcome IP-Gateway

Welcome IP-Gateway Firmware Version <= 6.20

Welcome IP-Gateway MDRC  Firmware Version <= 6.20

Welcome IP-Gateway Welcome M  Firmware Version <= 6.20

Welcome IP-Gateway Firmware Version >= 6.25

Welcome IP-Gateway MDRC Firmware Version >= 6.25

Welcome IP-Gateway Welcome M  Firmware Version >= 6.25

Missing deletion of a dangling pointer in Linux kernel may result in a use-after-free attack

CVE description

Summary: NVD - CVE-2024-56601

The vulnerabilities have been resolved in the firmware versions:  6.23 and later.

CVE-2024-56601

A use-after-free vulnerability in the Linux kernel's ipv4 stack

CVE description

Summary: NVD - CVE-2023-6932

CVE-2023-6932


Multiple vulnerabilities regarding the CODESYS Runtime System from CODESYS Group have been publicly reported. CODESYS Runtime System is utilized in the firmware of ABB ACS880 drives to provide IEC 61131-3 programming capabilities.

These vulnerabilities could lead to out-of-bound memory access. Successful exploit may result in a denial-of-service condition or arbitrary code execution. Firmware updates are available that mitigate the publicly reported vulnerabilities of the product versions listed as affected in this advisory.

Summary

Network communication between attacker and drives is needed to exploit the vulnerabilities. Thus, network isolation or protection will make the attack difficult and less likely to succeed. Please refer to ‘General security recommendations for further advise on how to keep your system secure.

Mitigating factors

For any installation of software-related ABB products we strongly recommend the following (non-exhaustive) list of cyber security practices:

– Isolate special-purpose networks (e.g., for automation systems) and remote devices behind firewalls, and separate them from any general-purpose network (e.g., office or home networks).

– Install physical controls so only authorized personnel can access your devices, components, peripheral equipment, and networks.

– Never connect programming software tools or computers containing programming software to any network other than the network where run the devices that it is intended for.

– Scan all data imported into your environment before use to detect potential malware infections.

– Minimize network exposure for all applications and endpoints to ensure that they are not accessible from the Internet unless they are designed for such exposure and the intended use requires it.

– Ensure all nodes are always up to date in terms of installed software, operating system, and firmware patches as well as anti-virus and firewall.

– When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.

General security recommendations

ABB has tested the following workarounds. Although these workarounds will not correct the underlying vulnerability, they can help block known attack vectors. When a workaround reduces functionality, this is identified below as “Impact of workaround”. For situations where firmware update is not feasible, ABB recommends mitigating the threat by setting following parameters:

For IGBT supply control program devices:

set parameter 196.102 to bit 2 to disable file download (for further bit description, please refer to drive firmware manual )

For other devices:

set parameter 96.102 to bit 2 to disable file download (for further bit description, please refer to drive firmware manuals)

Impact of workaround:
This workaround restricts IEC programs update, but existing IEC programs in Drives can still be used. To update an IEC program, the operator has to unlock the user lock and enable file download in a protected network environment.
It is strongly recommended to disable file download. The vulnerabilities are exploitable when file download is enabled.
Warning! – The user lock cannot be opened even by ABB if the pass code is lost.

Workarounds

Notice

Support

Summary: CODESYS Security Advisory 2023-04

Summary: CODESYS Security Advisory 2023-05

Summary: ACS880 primary control program (YINLX) Firmware manual

Summary: ACS880 primary control program (AINLX) Firmware manual

Summary: ACS880 IGBT supply control program (YISLX and YLHLX) firmware manual

ABB ACS880 +N8010 Drives CODESYS RTS Vulnerabilities

Summary: Initial version

Summary: Document ID updated

ABB

ACS880 Drives

ACS880 Primary Control Program

AINLX < v3.47

ACS880 Primary Control Program AINLX < v3.47

YINLX < v1.30

ACS880 Primary Control Program YINLX < v1.30

AINLX  >=v3.47

ACS880 Primary Control Program AINLX  >=v3.47

YINLX >= v1.30

ACS880 Primary Control Program YINLX >= v1.30

ACS880 IGBT Supply Control Program

AISLX < v3.43

ACS880 IGBT Supply Control Program AISLX < v3.43

ALHLX < v3.43

ACS880 IGBT Supply Control Program ALHLX < v3.43

YISLX < v1.30

ACS880 IGBT Supply Control Program YISLX < v1.30

YLHLX < v1.30

ACS880 IGBT Supply Control Program YLHLX < v1.30

AISLX >= v3.43

ACS880 IGBT Supply Control Program AISLX >= v3.43

ALHLX >= v3.43

ACS880 IGBT Supply Control Program ALHLX >= v3.43

YISLX >= v1.30

ACS880 IGBT Supply Control Program YISLX >= v1.30

YLHLX >= v1.30

ACS880 IGBT Supply Control Program YLHLX >= v1.30

ACS880 Position Control Program

APCLX <= v1.04.0.5

ACS880 Position Control Program APCLX <= v1.04.0.5

APCLX > v1.04.0.5

ACS880 Position Control Program APCLX > v1.04.0.5

ACS880 Test Bench Control Program

ATBLX <= v3.44.0.0

ACS880 Test Bench Control Program ATBLX <= v3.44.0.0

ATBLX > v3.44.0.0

ACS880 Test Bench Control Program ATBLX > v3.44.0.0

After successful authentication as a user in multiple CODESYS products in multiple versions, specific crafted network communication requests with inconsistent content can cause the CmpAppForce component to read internally from an invalid address, potentially leading to a denial-of-service condition.

CVE Description

Summary: NVD- CVE-2023-37559

In latest firmware versions for the affected products, ABB has mitigated the CODESYS Runtime System vulnerabilities. IEC online programming communication is disabled by default. As a result, CODESYS tools communication with the drive is disabled.

ABB recommends that customers apply the firmware update at earliest convenience.

For situations where firmware update is not feasible, please refer to ‘Workarounds’ section guidance

CVE-2023-37559

CVE Description

Summary: NVD - CVE-2023-37558

CVE-2023-37558

After successful authentication as a user in multiple CODESYS products in multiple versions, specific crafted remote communication requests can cause the CmpAppBP component to overwrite a heap-based buffer, which can lead to a denial-of-service condition

Description

Summary: NVD- CVE-2023-37557

CVE-2023-37557

In multiple versions of multiple CODESYS products, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpAppBP component to read internally from an invalid address, potentially leading to a denial-of-service condition.

CVE Description

Summary: NVD -  CVE-2023-37556

CVE-2023-37556

CVE Description

Summary: NVD - CVE-2023-37555

CVE-2023-37555

CVE description

Summary: NVD - CVE-2023-37554

CVE-2023-37554

CVE Description

Summary: NVD - CVE-2023-37553

CVE-2023-37553

CVE Description

Summary: NVD - CVE-2023-37552

CVE-2023-37552

In multiple CODESYS products in multiple versions, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpApp component to read internally from an invalid address, potentially leading to a denial-of-service condition.

CVE Description

Summary: NVD - CVE-2023-37550

CVE-2023-37550

CVE Description

Summary: NVD - CVE-2023-37549

CVE-2023-37549

CVE Description

Summary: NVD - CVE-2023-37548

CVE-2023-37548

CVE Description

Summary: NVD - CVE-2023-37547

CVE-2023-37547

CVE Description

Summary: NVD - CVE-2023-37546

CVE-2023-37546

CVE Description

Summary: NVD - CVE-2023-37545

CVE-2023-37545

Improper Restriction of Operations within the Bounds of a Memory Buffer

In CODESYS Control in multiple versions a improper restriction of operations within the bounds of a memory buffer allow an remote attacker with user privileges to gain full access of the device.

CVE Description

Summary: NVD - CVE-2022-4046

CVE-2022-4046


CODESYS group published several vulnerabilities regarding the CODESYS Runtime System, which is included in the firmware of ABB LV DC drives and power controllers. It is used to implement a selection of features and to provide IEC 611131-3 programming capabilities.
These vulnerabilities include memory corruption issues that could lead to out-of-bound memory access. Subsequently, a successful exploit could allow attackers to trigger a denial-of-service condition or execute arbitrary code over the fieldbus interfaces.   Exploiting these vulnerabilities requires an IEC 61131-3 license being present on the memory unit of the drive or power controller.

Summary

The vulnerabilities only pose a threat if an IEC 61131-3 license is provisioned to the memory unit.
The exploitation can be triggered via USB on the panel or via fieldbus or Ethernet using a fieldbus connector. If none of these are connected exploitation is not possible. For network based attacks the attacker needs to be able to reach the drive or power controller via the network.

Mitigating factors

For any installation of software-related ABB products we strongly recommend the following (non-exhaustive) list of cyber security practices:
–	Isolate special purpose networks (e.g. for automation systems) and remote devices behind firewalls and separate them from any general-purpose network (e.g. office or home networks).
–	Install physical controls so no unauthorized personnel can access your devices, components, peripheral equipment, and networks.
–	Minimize network exposure for all applications and endpoints to ensure that they are not accessible from the Internet unless they are designed for such exposure and the intended use requires such.
–	Ensure all nodes are always up to date in terms of installed software, operating system, and firmware patches as well as antivirus and firewall.
–	When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Also, understand that VPNs are only as secure as the connected devices.

General security recommendations

ABB has tested the following workarounds. Although these workarounds will not correct the underlying vulnerability, they can help block known attack vectors. When a workaround reduces functionality, this is identified below as Impact of workaround.

Activate User Lock and disable file upload

To mitigate the exploitability of the vulnerabilities ABB recommends disabling the upload of firmware, including IEC 61131-3 programs to the drive or power controller. Additionally, it is recommended to close the User Lock and enable the Parameter Lock, so an attacker is not able to unblock the firmware upload over fieldbus.
The settings can be applied via the Drive Composer tool. For the user lock to be effective and the parameter lock bound to the user lock, the following steps need to be performed:
DCS880

•	Enter the default user pass code 10000000 in 96.07 Pass code
•	Change the default user pass code to a random number using 96.100 Change user pass code and 96.101 Confirm user pass code
•	In 96.102 User lock functionality set bits 0, 2, 3 and 6 to 1 (high)
•	Bit 0: Disable ABB access levels
•	Bit 2: Disable file download
•	Bit 3: Disable Fieldbus write to hidden parameters
•	Bit 6: Protect AP
•	Enter any invalid pass code in 96.07 Pass code to close the lock
•	To enable the parameter lock set 96.07 Pass code = 358
•	In 96.04 Access Levels Active Bit 14 (parameter lock) is set
•	Enter your user pass code in 96.07 Pass code to open the lock
•	In 96.102 User lock functionality set bit 1 to 1 (high) to freeze the parameter lock state
•	Enter any invalid pass code in 96.07 Pass code to close the lock

DCT880

•	Enter the default user pass code 10000000 in 96.02 Pass code
•	Change the default user pass code to a random number using 96.100 Change user pass code and 96.101 Confirm user pass code
•	In 96.102 User lock functionality set bits 0, 2, 3 and 6 to 1 (high)
•	Bit 0: Disable ABB access levels
•	Bit 2: Disable file download
•	Bit 3: Disable Fieldbus write to hidden parameters
•	Bit 6: Protect AP
•	Enter any invalid pass code in 96.02 Pass code to close the lock
•	To enable the parameter lock set 96.02 Pass code = 358
•	In 96.03 Access Levels Active Bit 14 (parameter lock) is set
•	Enter your user pass code in 96.02 Pass code to open the lock
•	In 96.102 User lock functionality set bit 1 to 1 (high) to freeze the parameter lock state
•	Enter any invalid pass code in 96.02 Pass code to close the lock

Verification

Please be aware: If those steps are not performed in the correct order, the pass code might be circum-vented. Setting the correct User Lock Functionality bits is not enough to secure the device. Please make sure the lock is closed (parameters 96.100 to 96.102 not visible).
If the User Lock is open, warning 1236 is set.

Impact of the workaround

After applying the workaround, the IEC 61131-3 programs can be used, but not uploaded to the drive anymore. To upload an IEC program the operator has to unlock the User Lock and disable the File Up-load Lock.
If the parameter lock is applied no parameter of the drive can be changed. To change the parameter the operator has to unlock the User Lock and disable the parameter lock.
The disablement of the file downloads includes
•	Firmware uploads
•	Safety functions module FSO-21 configuration
•	Parameter restore to default values. See parameter 96.15 for details.
•	Loading of adaptive programs
•	Loading and debugging application programs via Drive application builder
•	Changing the home view of the control panel
•	Editing drive texts
•	Editing the favorite parameters list on the control panel
•	Configuration settings done via control panel (time, date, etc.)
It is strongly recommended to only unlock the User Lock in a maintenance scenario, not during normal operation. Enabling upload of files and therefore an update of firmware during operation could lead to undesired behavior. As long as the User Lock is open the vulnerabilities are exploitable.

Workarounds

The information in this document is subject to change without notice, and should not be construed as a commitment by ABB.
ABB provides no warranty, express or implied, including warranties of merchantability and fitness for a particular purpose, for the information contained in this document, and assumes no responsibility for any errors that may appear in this document. In no event shall ABB or any of its suppliers be liable for direct, indirect, special, incidental or consequential damages of any nature or kind arising from the use of this document, or from the use of any hardware or software described in this document, even if ABB or its suppliers have been advised of the possibility of such damages.
This document and parts hereof must not be reproduced or copied without written permission from ABB, and the contents hereof must not be imparted to a third party nor used for any unauthorized purpose.
All rights to registrations and trademarks reside with their respective owners.

Notice

For additional instructions and support please contact your local ABB service organization. For contact information, see www.abb.com/contactcenters.
Information about ABB’s cyber security program and capabilities can be found at www.abb.com/cybersecurity.

Support

Summary:
For more details about the individual vulnerabilities see the following advisories by CODESYS Group:
CDS-82457

Low Voltage DC Drives and Power Controllers CODESYS RTS Vulnerabilities

Summary: Initial version

Summary: Document ID updated

ABB

DC drives & power controllers

DCS880 memory unit incl. ABB Drive Application Builder license (IEC 61131-3)

DCT880 memory unit incl. ABB Drive Application Builder license (IEC 61131-3)

Power Optimizer

DCT880 memory unit incl. Power Optimizer

CVE Description

Summary: NVD- CVE-2023-37559

If the drive or power controller is in an exploitable configuration, ABB recommends immediately applying the mitigations described in the Workarounds section.

CVE-2023-37559

CVE Description

Summary: NVD - CVE-2023-37558

CVE-2023-37558

Description

Summary: NVD- CVE-2023-37557

CVE-2023-37557

CVE Description

Summary: NVD -  CVE-2023-37556

CVE-2023-37556

CVE Description

Summary: NVD - CVE-2023-37555

CVE-2023-37555

CVE description

Summary: NVD - CVE-2023-37554

CVE-2023-37554

CVE Description

Summary: NVD - CVE-2023-37553

CVE-2023-37553

CVE Description

Summary: NVD - CVE-2023-37552

CVE-2023-37552

CVE Description

Summary: NVD - CVE-2023-37550

CVE-2023-37550

CVE Description

Summary: NVD - CVE-2023-37549

CVE-2023-37549

CVE Description

Summary: NVD - CVE-2023-37548

CVE-2023-37548

CVE Description

Summary: NVD - CVE-2023-37547

CVE-2023-37547

CVE Description

Summary: NVD - CVE-2023-37546

CVE-2023-37546

CVE Description

Summary: NVD - CVE-2023-37545

CVE-2023-37545

CVE Description

Summary: NVD - CVE-2022-4046

CVE-2022-4046


Multiple vulnerabilities regarding the CODESYS Runtime System from CODESYS Group have been publicly reported. CODESYS Runtime System v.3.5.15.0 is utilized in the firmware of ABB MV ACS6080 and ACS5000 drives to provide IEC 61131 programming capabilities.
These vulnerabilities could lead to out-of-bound memory access. A successful exploit may result in a denial-of-service condition or arbitrary code execution.
Firmware updates are available to address the vulnerabilities in products listed as affected in this advisory.

Summary

To exploit these vulnerabilities, a successful login to the affected product is required. This can be achieved by one of the following methods:

•	Connecting a computer to the Drive, that is running Drive Automation Builder (Automation Builder | ABB) or Drive Composer (Drive Composer - Software tools | ABB).

•	Having access to the local network where the drive is located. In this case, an attacker could send mal-formed packets directly to the drive.

To make the attack more difficult and less likely to succeed, provide network isolation where the drive is located and ensure that no computer running Drive Automation Builder or Drive Composer is connected to the drive without proper security controls. Please refer to “General security recommendations” for further advise on how to keep drive secure.
Refer to the “General Security Recommendations” section at the end of this document for further mitigation actions.

Mitigating factors

For situations where the “Recommended immediate actions” are not feasible, ABB proposes the following workaround to mitigate this threat:

•	Set bit 2 "Disable file download” to TRUE in the "96.102 User lock functionality" parameter.

Although these workarounds will not correct the underlying vulnerability, they can help block known attack vectors. Please refer to “Impact of workaround” section to understand possible reduced functionality of the drive.

IMPORTANT: Contact a qualified and certified ABB personnel if you need more information about the parameter handling of the affected products.

Impact of workaround

This workaround restricts the updating of IEC programs, but existing IEC programs on Drives can still be used. To update an IEC program, the operator must unlock the user lock and enable file download in a protected network environment. It is highly recommended to disable file download, as vulnerabilities are more easily exploitable when file download is enabled.
WARNING: The user lock cannot be opened even by ABB if the pass code is lost.

Workarounds

For any installation of software-related ABB products we strongly recommend the following (non-exhaustive) list of cyber security practices:
•	Isolate special purpose networks (e.g. for automation systems) and remote devices behind firewalls and separate them from any general-purpose network (e.g. office or home networks).
•	Install physical controls so no unauthorized personnel can access your devices, components, peripheral equipment, and networks.
•	Never connect programming software or computers containing programing software to any network other than the network for the devices that it is intended for.
•	Scan all data imported into your environment before use to detect potential malware infections.
•	Minimize network exposure for all applications and endpoints to ensure that they are not accessible from the Internet unless they are designed for such exposure and the intended use requires such.
•	Ensure all nodes are always up to date in terms of installed software, operating system, and firmware patches as well as anti-virus and firewall.
•	When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.
•	Install the drive in a secure location that is only accessible to authorized persons.
•	Install physical controls so only authorized personnel can access devices connected to the drive (computers, peripheral equipment, and networks).
•	Avoid connecting computers containing Drive Automation Builder programing software to any network other than the network for the devices that it is intended for.
•	Ensure security controls are followed on computers connected to the Drive. For example, updated security patches, firewall, anti-virus are installed, and only authorized Software is running. It is customer responsibility to ensure these conditions.
More information on recommended practices can be found in the reference section document:  Protecting operations through cyber security: ABB Drives solutions.

General security recommendations

Support

The information in this document is subject to change without notice, and should not be construed as a commitment by ABB.
ABB provides no warranty, express or implied, including warranties of merchantability and fitness for a particular purpose, for the information contained in this document, and assumes no responsibility for any errors that may appear in this document. In no event shall ABB or any of its suppliers be liable for direct, indirect, special, incidental or consequential damages of any nature or kind arising from the use of this document, or from the use of any hard-ware or software described in this document, even if ABB or its suppliers have been advised of the possibility of such damages.
This document and parts hereof must not be reproduced or copied without written permission from ABB, and the contents hereof must not be imparted to a third party nor used for any unauthorized purpose.
All rights to registrations and trademarks reside with their respective owners.

Notice

Summary: CODESYS Security Advisory 2023-04

Summary: CODESYS Security Advisory 2023-05

Summary: What is a variable speed drive | Drives | ABB

Summary: ACS6080 - ABB medium voltage AC drives medium voltage AC drives | ABB

Summary: ACS5000 - ABB medium voltage AC drives medium voltage AC drives | ABB

ABB MV Drives Affected by CODESYS RTS (Runtime System) Vulnerabilities

Summary: Initial Version

ACS6080 Firmware Version  >=LAAAA 2.10.0|<=LAAAB 5.06.1

ACS5000 Firmware Version  >=LAAAB 4.03.0|<= LAAAB 5.06.1

ACS6000 Firmware Version >=LAAAA 2.10.0|<=LAAAB 5.06.1

The CODESYS Control runtime system does not restrict the memory access. An improper restriction of operations within the bounds of a memory buffer allows an attacker with access to the drive with user privileges to gain full access of the drive.

CVE Description

Summary: NVD - CVE-2022-4046

ABB recommends that customers apply a firmware update as soon as possible to the latest firmware, i.e. LAAAB v. 5.07 and higher, for the affected products. ABB has addressed the CODESYS Runtime System vulnerabilities by disabling the IEC online programming communication by default. As a result, CODESYS communication between affected products and the ABB Automation Builder or ABB Drive Application Builder tools is disabled.
It should be noted that the CODESYS application continues to run on the Drive and if it is necessary to establish communication with CODESYS RTS, for example to debug the CODESYS application, this is possible through the drive parameter configuration. Open the user lock via the "96.02 Pass code" parameter and make sure that bit 9 "Enable online IEC programming" is set to TRUE in the "96.102 User lock functionality" parameter.

IMPORTANT: After this task, be sure to disable CODESYS communication by setting the bit back to FALSE.
A future firmware update is planned to update the CODESYS RTS library, which will further strengthen defenses for the vulnerabilities mentioned above.

For situations where firmware update is not feasible, please refer to “Workarounds” section.

CVE-2022-4046

CVE Description

Summary: NVD - CVE-2023-37550

CVE-2023-37550

CVE Description

Summary: NVD- CVE-2023-37549

CVE-2023-37549

CVE Description

Summary: NVD - CVE-2023-37548

CVE-2023-37548

CVE Description

Summary: NVD - CVE-2023-37547

CVE-2023-37547

CVE Description

Summary: NVD - CVE-2023-37546

CVE-2023-37546

CVE Description

Summary: NVD- CVE-2023-37545

CVE-2023-37545

CVE Description

Summary: NVD - CVE-2023-37556

CVE-2023-37556

CVE Description

Summary: NVD - CVE-2023-37555

CVE-2023-37555

CVE Description

Summary: NVD - CVE-2023-37554

CVE-2023-37554

CVE Description

Summary: NVD - CVE-2023-37553

CVE-2023-37553

CVE Description

Summary: NVD - CVE-2023-37552

CVE-2023-37552

After successful authentication as a user in multiple CODESYS products in multiple versions, specific crafted remote communication requests can cause the CmpAppBP component to overwrite a heap-based buffer, which can lead to a denial-of-service condition.

CVE Description

Summary: NVD - CVE-2023-37557

CVE-2023-37557

After successful authentication as a user in multiple CODESYS products in multiple versions, specific crafted network communication requests with inconsistent content can cause the CmpAppForce component to read internally from an invalid address, potentially leading to a denial-of-service condition.

CVE Description

Summary: NVD - CVE-2023-37559

CVE-2023-37559

CVE Description

Summary: NVD - CVE-2023-37558

CVE-2023-37558


© Copyright 2025 ABB. All rights reserved.

ABB became aware of vulnerabilities in ASPECT product versions listed as affected in the advisory. The earliest report dates to June 2023. ABB has fixed most of the vulnerabilities reported. At the moment there are no plans of corrective measures for remaining vulnerabilities in the affected products.
ASPECT is an on-premise Building Management System (BMS) that provides an additional option to be remotely accessible. In order to support customers’ demand for cloud connectivity, ABB has decided to replace ASPECT and will introduce customers to a new solution based on the latest Industry level cyber security standards. The new solution will bring HW and SW capabilities that reflect state-of-the-art technology and is delivered including a maintenance plan that offers customers the best planning security.
Customers who have concerns about continuing the operation of ASPECT may contact ABB sales service to become advised about further support options.

Summary

For any installation of software-related ABB products and especially for products in scope of the ASPECT product line, we strongly recommend the following (non-exhaustive) list of cyber security practices:

•	Ensure that all ASPECT products are upgraded to the latest firmware version. Please find the latest version of ASPECT firmware on the respective product homepage

•	Isolate special purpose networks (e.g. for automation systems) and remote devices behind firewalls and separate them from any general-purpose network (e.g. office or home networks).

•	Install physical controls so no unauthorized personnel can access your devices, components, peripheral equipment, and networks.

•	Never connect programming software or computers containing programming software to any network other than the network for the devices that it is intended for.

•	Scan all data imported into your environment before use to detect potential malware infections.

•	Minimize network exposure for all ASPECT ports and endpoints to ensure that they are not accessible directly from the Internet.

•	Ensure all nodes are always up to date in terms of installed software, operating system, and firmware patches as well as antivirus and firewall.

•	When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available.

•	Authorized users shall change all default credentials during commissioning of an ASPECT system. If credentials have not been changed during commission state, ABB advises to change each changeable credential at the earliest

General security recommendations

For additional instructions and support please contact your local ABB service organization. For contact information, see www.abb.com/contactcenters.
Information about ABB’s cyber security program and capabilities can be found at www.abb.com/cybersecurity

Support

Notice

The vulnerabilities reported in scope of this document are only exploitable if attackers can access the network segment where ASPECT is installed and exposed directly to the internet. ABB therefore recommends the following guidelines to protect customer networks:

• ASPECT devices should never be exposed directly to the Internet either via a direct ISP connection nor via NAT port forwarding. If remote access to an ASPECT system is a customer requirement, the system shall operate behind a firewall. Users accessing ASPECT remotely shall do this using a VPN Gateway allowing access to the network segment where ASPECT is installed and configured

• Note: it is crucial that the VPN Gateway and Network is set up in accordance with best industry standards and maintained in terms of security patches for all related components

• Authorized users shall change all default credentials during commissioning of an ASPECT system. If credentials have not been changed during commission state, ABB advises to change each changeable credential at the earliest

• Ensure that all ASPECT products are upgraded to the latest firmware version. Please find the latest version of ASPECT firmware on the respective product homepage

Mitigating factors

Summary: ABB strongly advises customers and system integrators to follow the instructions documented in: FBXi, CBXi and ASPECT® SOLUTIONS, which can be downloaded from the ABB library.

ELSB/BLBA ASPECT advisory several CVEs

Summary: Initial version.

Summary: CVE corrections

Summary: Removed CVE-2024-51547 due to duplicate with an earlier advisory

ABB

ASPECT®-Enterprise

ASP-ENT-x

ASPECT®-Enterprise ASP-ENT-x version <=3.08.03

ASPECT®-Enterprise ASP-ENT-x version 3.08.04

NEXUS Series

NEXUS Series NEXUS-3-x version <=3.08.03

Summary: reporting the vulnerabilities through responsible disclosure.

An escalation of privilege vulnerability in ASPECT could provide an attacker root access to a server when logged in as a "non" root ASPECT user. This issue affects ASPECT <= 3.08.03

CVE description

Summary: NVD - CVE-2024-48853

The vulnerabilities have been resolved in the following product versions:
3.08.04 and later.

CVE-2024-48853

Absolute File Traversal vulnerabilities in ASPECT allows access and modification of unintended resources. This issue affects ASPECT<= 3.08.03

CVE description

Summary: NVD - CVE-2024-48850

CVE-2024-48850

Improper Control of Generation of Code ('Code Injection')

Remote Code Execution vulnerabilities are present in ASPECT if session administrator credentials become compromised. This issue affects ASPECT<= 3.08.03

CVE description

Summary: NVD - CVE-2024-9639

CVE-2024-9639

Improper Control of Resource Identifiers ('Resource Injection')

Port manipulation vulnerabilities in ASPECT provide attackers with the ability to control TCP/IP port access if session administrator credentials become compromised. This issue affects ASPECT <= 3.08.03.

CVE description

Summary: NVD - CVE-2025-2410

CVE-2025-2410

File corruption vulnerabilities in ASPECT provide attackers access to overwrite system files if session administrator credentials become compromised. This issue affects ASPECT <= 3.08.03.

CVE description

Summary: NVD - CVE-2025-2409

CVE-2025-2409

Exposure of Sensitive System Information to an Unauthorized Control Sphere

Exposure of file path, file size or file existence vulnerabilities in ASPECT provide attackers access to file system information if session administrator credentials become compromised. This issue affects ASPECT <= 3.08.03

CVE description

Summary: NVD - CVE-2025-30170

CVE-2025-30170

System File Deletion vulnerabilities in ASPECT provide attackers access to delete system files if session administrator credentials become compromised. This issue affects ASPECT <= 3.08.03

CVE description

Summary: NVD - CVE-2025-30171

CVE-2025-30171

CVE description

Summary: NVD - CVE-2025-30172

CVE-2025-30172

Unrestricted Upload of File with Dangerous Type

File upload vulnerabilities are present in ASPECT if session administrator credentials become compromised. This issue affects ASPECT <= 3.08.03

CVE description

Summary: NVD - CVE-2025-30173

CVE-2025-30173

File upload and execute vulnerabilities in ASPECT allow PHP script injection if session administrator credentials become compromised. This issue affects ASPECT <= 3.08.03

CVE description

Summary: NVD - CVE-2025-30169

CVE-2025-30169

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

SQL injection vulnerabilities in ASPECT allow unintended access and manipulation of database repositories if session administrator credentials become compromised. This issue affects ASPECT <= 3.08.03

CVE description

Summary: NVD - CVE-2024-13928

CVE-2024-13928

Servlet injection vulnerabilities in ASPECT allow remote code execution if session administrator credentials become compromised. This issue affects ASPECT <= 3.08.03

CVE description

Summary: NVD - CVE-2024-13929

CVE-2024-13929

An Unchecked Loop Condition in ASPECT provides an attacker the ability to maliciously consume system resources if session administrator credentials become compromised. This issue affects ASPECT <= 3.08.03

CVE description

Summary: NVD - CVE-2024-13930

CVE-2024-13930

Relative Path Traversal vulnerabilities in ASPECT allow access to file resources if session administrator credentials become compromised. This issue affects ASPECT <= 3.08.03

CVE description

Summary: NVD - CVE-2024-13931

CVE-2024-13931

Stored Absolute Path Traversal vulnerabilities in ASPECT could expose sensitive data if administrator credentials become compromised. This issue effects all versions of ASPECT.

CVE description

Summary: NVD - CVE-2024-13945

ABB recommend applying the "Mitigating factors"

CVE-2024-13945

DLL's are not digitally signed when loaded in ASPECT's configuration toolset exposing the application to binary planting during device commissioning. This issue affects all versions of ASPECT.

CVE description

Summary: NVD - CVE-2024-13946

CVE-2024-13946

Device commissioning parameters in ASPECT may be modified by an external source if administrative credentials become compromised. This issue affects all versions of ASPECT.

CVE description

Summary: NVD - CVE-2024-13947

CVE-2024-13947

Windows permissions for ASPECT configuration toolsets are not fully secured allowing exposure of configuration information. This issue affects all versions of ASPECT.

CVE description

Summary: NVD - CVE-2024-13948

CVE-2024-13948

Allocation of File Descriptors or Handles Without Limits or Throttling

Large content vulnerabilities are present in ASPECT exposing a device to disk overutilization on a system if administrator credentials become compromised. This issue affects all versions of ASPECT.

CVE description

Summary: NVD - CVE-2024-48848

CVE-2024-48848

Log forging vulnerabilities in ASPECT provide attacker access to manipulate log messages with false information if administrator credentials become compromised. This issue affects all versions of ASPECT.

CVE description

Summary: NVD - CVE-2024-13949

CVE-2024-13949

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Log injection vulnerabilities in ASPECT provide attacker access to inject malicious browser scripts if administrator credentials become compromised. This issue affects all versions of ASPECT.

CVE description

Summary: NVD - CVE-2024-13950

CVE-2024-13950

Use of a One-Way Hash with a Predictable Salt

One way hash with predictable salt vulnerabilities in ASPECT may expose sensitive information to a potential attacker. This issue affects all versions of ASPECT.

CVE description

Summary: NVD - CVE-2024-13951

CVE-2024-13951

Predictable filename vulnerabilities in ASPECT may expose sensitive information to a potential attacker if administrator credentials become compromised. This issue affects all versions of ASPECT.

CVE description

Summary: NVD - CVE-2024-51553

CVE-2024-51553

Remote Code Execution vulnerabilities are present in ASPECT if administrator credentials become compromised . This issue affects all versions of ASPECT.

CVE description

Summary: NVD - CVE-2024-13952

CVE-2024-13952

Exposure of Private Personal Information to an Unauthorized Actor

Sensitive device logger information in ASPECT may be exposed if administrator credentials become compromised. This issue affects all versions of ASPECT.

CVE description

Summary: NVD - CVE-2024-13953

CVE-2024-13953

Insecure Storage of Sensitive Information

Serialized configuration information may be disclosed during device commissioning while using ASPECT's configuration toolset. This issue affects all versions of ASPECT

CVE description

Summary: NVD - CVE-2024-13954

CVE-2024-13954

2nd Order SQL injection vulnerabilities in ASPECT allow unintended access and manipulation of database repositories if administrator credentials become compromised. This issue affects all versions of ASPECT.

CVE description

Summary: NVD - CVE-2024-13955

CVE-2024-13955

SSL Verification Bypass vulnerabilities exist in ASPECT if administrator credentials become compromised. This issue affects all versions of ASPECT.

CVE description

Summary: NVD - CVE-2024-13956

CVE-2024-13956

SSRF Server Side Request Forgery vulnerabilities exist in ASPECT if administrator credentials become compromised. This issue affects all versions of ASPECT.

CVE description

Summary: NVD - CVE-2024-13957

CVE-2024-13957

Stored Cross Site Scripting vulnerabilities exist in ASPECT if administrator credentials become compromised. This issue affects all versions of ASPECT.

CVE description

Summary: NVD - CVE-2024-13958

CVE-2024-13958

Storing Passwords in a Recoverable Format

Weak password storage vulnerabilities exist in ASPECT if administrator credentials become compromised. This issue affects all versions of ASPECT.

CVE description

Summary: NVD - CVE-2024-51552

CVE-2024-51552


Summary: working with us to help protect customers

Summary: describing the findings and helping to verify the resolving implementation

ABB is aware of vulnerabilities in the product versions listed as affected in the advisory. A firmware update is available that resolves these privately reported vulnerabilities in the product versions listed as affected in the advisory.
An attacker who successfully exploited these vulnerabilities could access sensitive information stored inside the device and can change the configuration of the device .

Summary

Recommended security practices and firewall configurations can help protect a process control network from attacks that originate from outside the network. Such practices include that process control systems are physically protected from direct access by unauthorized personnel, have no direct connections to the Internet, and are separated from other networks by means of a firewall system that has a minimal number of ports exposed, and others that have to be evaluated case by case. Process control systems should not be used for Internet surfing, instant messaging, or receiving e-mails. Portable computers and removable storage media should be carefully scanned for viruses before they are connected to a control system.
More information on recommended practices can be found in the documents listed in the Reference section.

Mitigating factors

For any installation of software-related ABB products and especially for products in scope of the EIBPORT product line, we strongly recommend the following (non-exhaustive) list of cyber security practices:

•	Ensure that all EIBPORT products are upgraded to the latest firmware version. Please find the latest version of EIBPORT firmware on the respective product homepage.

•	Isolate special purpose networks (e.g. for automation systems) and remote devices behind firewalls and separate them from any general-purpose network (e.g. office or home networks).

•	Install physical controls so no unauthorized personnel can access your devices, components, peripheral equipment, and networks.

•	Never connect programming software or computers containing programming software to any network other than the network for the devices that it is intended for.

•	Scan all data imported into your environment before use to detect potential malware infections.

•	Minimize network exposure for all EIBPORT ports and endpoints to ensure that they are not accessible directly from the Internet.

•	Ensure all nodes are always up to date in terms of installed software, operating system, and firmware patches as well as anti-virus and firewall.

•	When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available.

•	Authorized users shall change all default credentials during commissioning of an EIBPORT system. If credentials have not been changed during commission state, ABB advises to change each changeable credential at the earliest.

More information on recommended practices can be found in the documents listed in the Reference section.

General security recommendations

The information in this document is subject to change without notice, and should not be construed as a commitment by ABB.
ABB provides no warranty, express or implied, including warranties of merchantability and fitness for a particular purpose, for the information contained in this document, and assumes no responsibility for any errors that may appear in this document. In no event shall ABB or any of its suppliers be liable for direct, indirect, special, incidental or consequential damages of any nature or kind arising from the use of this document, or from the use of any hardware or software de-scribed in this document, even if ABB or its suppliers have been advised of the possibility of such damages.
This document and parts hereof must not be reproduced or copied without written permission from ABB, and the contents hereof must not be imparted to a third party nor used for any unauthorized purpose.
All rights to registrations and trademarks reside with their respective owners.

Notice

For additional instructions and support please contact your local ABB service organization. For contact information, see www.abb.com/contactcenters.
Information about ABB’s cyber security program and capabilities can be found at www.abb.com/cybersecurity.

Support

Summary: Supplier of Firmware

Summary: Hardening guide for EIBPORT

Summary: System Manual 1

Summary: System Manual 2

Summary: ABB Hardening guide for general EIB and other products

Summary: ABB CYBERSECURITY ADVISORY - PDF version

Summary: ABB CYBERSECURITY ADVISORY - CSAF version

EIBPORT Session Management Fail

Summary: Initial version

Summary: CVE ID Corrected

This vulnerability allows the successful attacker to gain unauthorized access to a configuration web page delivered by the integrated web Server of EIBPORT.

CVE Description

ABB recommends that customers apply the update at the earliest convenience.  The vulnerabilities have been resolved in the product version: 3.9.9

CVE-2024-13967


Summary: helping to identify the vulnerabilities and protecting our customers

ABB is aware of vulnerabilities in the product versions listed as affected in the advisory.

An attacker who successfully exploited these vulnerabilities could gain unauthenticated access to the MQTT configu-ration data (CVE-2025-6074), cause a DoS on the MQTT configuration web server (REST interface) (CVE-2025-6073, CVE-2025-6072), or decrypt encrypted MQTT broker credentials (CVE-2025-6071).

summary

For any installation of software-related ABB products we strongly recommend the following (non-exhaustive) list of cyber security practices:

–	Isolate special purpose networks (e.g. for automation systems) and remote devices behind firewalls and separate them from any general purpose network (e.g. office or home networks).

–	Install physical controls so no unauthorized personnel can access your devices, components, peripheral equip-ment, and networks.

–	Never connect programming software or computers containing programing software to any net-work other than the network for the devices that it is intended for.

–	Scan all data imported into your environment before use to detect potential malware infections.

–	Minimize network exposure for all applications and endpoints to ensure that they are not accessible from the Internet unless they are designed for such exposure and the intended use requires such.

–	Ensure all nodes are always up to date in terms of installed software, operating system and firmware patches as well as anti-virus and firewall.

–	When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.

General security recommendations

For additional instructions and support please contact your local ABB service organization.
For contact
information, see www.abb.com/contactcenters.

Information about ABB’s cyber security program and capabilities can be found at www.abb.com/cybersecurity.

support

The information in this document is subject to change without notice, and should not be construed as a commitment by ABB.

ABB provides no warranty, express or implied, including warranties of merchantability and fitness for a particular purpose, for the information contained in this document, and assumes no responsibility for any errors that may appear in this document. In no event shall ABB or any of its suppliers be liable for direct, indirect, special, incidental or consequential damages of any nature or kind arising from the use of this document, or from the use of any hard-ware or software described in this document, even if ABB or its suppliers have been advised of the possibility of such damages.

This document and parts hereof must not be reproduced or copied without written permission from ABB, and the contents hereof must not be imparted to a third party nor used for any unauthorized purpose.

All rights to registrations and trademarks reside with their respective owners.

Notice

ABB recommends disabling the REST interface when not being used to configure the MQTT functionality. By default, the REST interface is disabled so no risk is present.

The RMC-100 is not intended for access over public networks such as the internet. An attacker would need to have access to the customer’s private control network to exploit this vulnerability. Proper network segmentation is rec-ommended.

Refer to section “General security recommendations” for further advise on how to keep your system secure.

Mitigating factors

RMC - 100 Vulnerabilities in web UI (REST Interface)

Summary: Initial version.

Summary: Added information on the software customer packages that correct the reported issue.

When the REST interface is enabled by the user, and an attacker gains access to source code and control network, the attacker can bypass the REST interface authentication and gain access to MQTT configuration data.

CVE description

Summary: NVD -CVE-2025-6074

The problem is corrected in RMC-100
version (2105457-046) and
RMC-100 LITE version (2106229-018)

CVE-2025-6074

When the REST interface is enabled by the user, and an attacker gains access to the con-trol network, and user/password broker authentication is enabled, and CVE-2025-6074 is exploited, the attacker can overflow the buffer for username or password.

CVE description

Summary: NVD -CVE-2025-6073

CVE-2025-6073

When the REST interface is enabled by the user, and an attacker gains access to the con-trol network, and CVE-2025-6074 is exploited, the attacker can use the JSON configura-tion to overflow the date of expiration field.

CVE description

Summary: NVD -CVE-2025-6072

CVE-2025-6072

Attacker can gain access to salted information to decrypt MQTT information.

CVE description

CVE-2025-6071


© Copyright 2025 ABB. All rights reserved.

ABB became aware of vulnerabilities in ASPECT product versions listed as affected in the advisory. The earliest report dates to June 2023. ABB has fixed most of the vulnerabilities reported. At the moment there are no plans of corrective measures for remaining vulnerabilities in the affected products.
ASPECT is an on-premise Building Management System (BMS) that provides an additional option to be remotely accessible. In order to support customers’ demand for cloud connectivity, ABB has decided to replace ASPECT and will introduce customers to a new solution based on the latest Industry level cyber security standards. The new solution will bring HW and SW capabilities that reflect state-of-the-art technology and is delivered including a maintenance plan that offers customers the best planning security.
Customers who have concerns about continuing the operation of ASPECT may contact ABB sales service to become advised about further support options.

Summary

For any installation of software-related ABB products and especially for products in scope of the ASPECT product line, we strongly recommend the following (non-exhaustive) list of cyber security practices:

•	Ensure that all ASPECT products are upgraded to the latest firmware version. Please find the latest version of ASPECT firmware on the respective product homepage

•	Isolate special purpose networks (e.g. for automation systems) and remote devices behind firewalls and separate them from any general-purpose network (e.g. office or home networks).

•	Install physical controls so no unauthorized personnel can access your devices, components, peripheral equipment, and networks.

•	Never connect programming software or computers containing programming software to any network other than the network for the devices that it is intended for.

•	Scan all data imported into your environment before use to detect potential malware infections.

•	Minimize network exposure for all ASPECT ports and endpoints to ensure that they are not accessible directly from the Internet.

•	Ensure all nodes are always up to date in terms of installed software, operating system, and firmware patches as well as antivirus and firewall.

•	When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available.

•	Authorized users shall change all default credentials during commissioning of an ASPECT system. If credentials have not been changed during commission state, ABB advises to change each changeable credential at the earliest

General security recommendations

For additional instructions and support please contact your local ABB service organization. For contact information, see www.abb.com/contactcenters.
Information about ABB’s cyber security program and capabilities can be found at www.abb.com/cybersecurity

Support

The information in this document is subject to change without notice, and should not be construed as a commitment by ABB.
ABB provides no warranty, express or implied, including warranties of merchantability and fitness for a particular purpose, for the information contained in this document, and assumes no responsibility for any errors that may appear in this document. In no event shall ABB or any of its suppliers be liable for direct, indirect, special, incidental or consequential damages of any nature or kind arising from the use of this document, or from the use of any hardware or software described in this document, even if ABB or its suppliers have been advised of the possibility of such damages.
This document and parts hereof must not be reproduced or copied without written permission from ABB, and the contents hereof must not be imparted to a third party nor used for any unauthorized purpose.
All rights to registrations and trademarks reside with their respective owners.

Notice

Mitigating factors

ELSB/BLBA ASPECT advisory several CVEs

Summary: Initial version.

Summary: CVE correction

Summary: CVSS vectors and scores corrected

Summary:
Merging CVEs due to a common root cause
The following CVE’s have been rejected/removed by ABB:
- CVE-2025-53188
- CVE-2025-53189
- CVE-2025-53190
- CVE-2025-53191

Summary: Updated the CWE for two CVE records

Summary: Correction in the CVE description

Authentication Bypass Using an Alternate Path or Channel

Due to an issue in configuration, code that was intended for debugging purposes,
was included in the market release of the ASPECT FW allowing to bypass authentication in particular context. An attacker was able to change the system time, access
files and make function calls (RCE) without prior authentication.
This issue affects all versions of ASPECT <3.08.04-s01

CVE description

Summary: NVD - CVE-2025-53187

The vulnerabilities have been resolved in the following product versions:
3.08.04-s01 and later.

CVE-2025-53187

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

A DoS attack is possible if access to the local network is provided to unauthorized
users. This issue affects all versions of ASPECT <3.08.04-s01

CVE description

Summary: NVD - CVE-2025-7677

No plans of corrective measures.

The vulnerabilities reported in scope of this document are only exploitable if attackers can access the network segment where ASPECT is installed and exposed directly to the internet. ABB therefore recommends the following guidelines to protect customer networks:

• ASPECT devices should never be exposed directly to the Internet either via a direct ISP connection nor via NAT port forwarding. If remote access to an ASPECT system is a customer requirement, the system shall operate behind a firewall. Users accessing ASPECT remotely shall do this using a VPN Gateway allowing access to the network segment where ASPECT is installed and configured

• Note: it is crucial that the VPN Gateway and Network is set up in accordance with best industry standards and maintained in terms of security patches for all related components

• Authorized users shall change all default credentials during commissioning of an ASPECT system. If credentials have not been changed during commission state, ABB advises to change each changeable credential at the earliest

• Ensure that all ASPECT products are upgraded to the latest firmware version. Please find the latest version of ASPECT firmware on the respective product homepage

CVE-2025-7677

The ASPECT system allows users to bypass authentication.

This issue affects all versions of
ASPECT <3.08.04-s01

CVE description

Summary: NVD -CVE-2025-7679

CVE-2025-7679


ABB is aware of vulnerabilities in the product versions listed as affected in the advisory.
An attacker who successfully exploited this vulnerability could gain physical, unauthorized access to a
Building where the product is installed

summary

For any installation of software-related ABB products we strongly recommend the following (non-exhaustive) list of cyber security practices:

–	Isolate special purpose networks (e.g. for automation systems) and remote devices behind firewalls and separate them from any general purpose network (e.g. office or home networks).

–	Install physical controls so no unauthorized personnel can access your devices, components, peripheral equipment, and networks.

–	Never connect programming software or computers containing programing software to any network other than the network for the devices that it is intended for.

–	Scan all data imported into your environment before use to detect potential malware infections.

–	Minimize network exposure for all applications and endpoints to ensure that they are not accessible from the Internet unless they are designed for such exposure and the intended use requires such.

–	Ensure all nodes are always up to date in terms of installed software, operating system and firmware patches as well as anti-virus and firewall.

–	When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.

General security recommendations

For additional instructions and support please contact your local ABB service organization.
For contact
information, see www.abb.com/contactcenters.

Information about ABB’s cyber security program and capabilities can be found at www.abb.com/cybersecurity.

support

The information in this document is subject to change without notice, and should not be construed as a commitment by ABB.

ABB provides no warranty, express or implied, including warranties of merchantability and fitness for a particular purpose, for the information contained in this document, and assumes no responsibility for any errors that may appear in this document. In no event shall ABB or any of its suppliers be liable for direct, indirect, special, incidental or consequential damages of any nature or kind arising from the use of this document, or from the use of any hard-ware or software described in this document, even if ABB or its suppliers have been advised of the possibility of such damages.

This document and parts hereof must not be reproduced or copied without written permission from ABB, and the contents hereof must not be imparted to a third party nor used for any unauthorized purpose.

All rights to registrations and trademarks reside with their respective owners.

Notice

ABB recommends double check the system handbook of a Busch-Welcome® two wire system regarding
security advises for the correct installation.

Mitigating factors

Summary: Guide for network security in building systems control

Busch-Welcome® 2 wire Door opener actuator by default in compatibility mode.

Summary: Initial version.

ABB

Switch Actuator 4 DU

Switch Actuator 4 DU -83330 - All Versions

Switch actuator, door/light 4 DU

Switch actuator, door/light 4 DU -83330-500 - All Versions

Authentication bypass due to compatibility mode enabled by default

CVE description

Summary: NVD -CVE-2025-7705

The following actions need to be executed on premise where the respective Busch-Welcome® System is  installed:

• While the Busch-Welcome® System is in operation, toggle the mode switch on the product from
“Door-Open” - to “Light” – Mode, wait one second and switch back to “Door-Open” - Mode.

• Restart the Busch-Welcome® System with a Power reset (mains power off and on again).
By executing the above steps, the system will recalibrate itself during boot up and will correct the misconfiguration automatically.

ABB recommends that customers apply the above listed actions at the earliest convenience.

CVE-2025-7705


Summary: helping to identify the vulnerabilities and protecting our customers.

ABB is aware of vulnerabilities in the product versions listed as affected in the advisory.

FLXEON devices are not intended to be internet-facing. A product advisory issued in June 2023 informed
customers of this parameter.

An attacker can successfully exploit these vulnerabilities and could take remote control of the product
and potentially insert and run arbitrary code.
ABB requires, as noted in previous security advisories and user documentation, that FLXEON should not be exposed to the internet or any other insecure network.

Note: In order to exploit an FLXEON, an attacker would need a misconfigured system.

ABB strongly advises customers and system integrators to follow the instructions documented in: FBXi,
CBXi and ASPECT® SOLUTIONS, which can be downloaded from the ABB library.

Summary

For any installation of software-related ABB products and especially for products in scope of the FLXEON product line, we strongly recommend the following (non-exhaustive) list of cyber security practices:

• Ensure that all FLXEON products are upgraded to the latest firmware version. Please find the latest version of FLXEON firmware on the respective product homepage.

• Isolate special purpose networks (e.g. for automation systems) and remote devices behind firewalls and separate them from any general-purpose network (e.g. office or home networks).

• Install physical controls so no unauthorized personnel can access your devices, components, peripheral equipment, and networks.

• Never connect programming software or computers containing programing software to any network other than the network for the devices that it is intended for.

• Scan all data imported into your environment before use to detect potential malware infections.

• Minimize network exposure for all FLXEON ports and endpoints to ensure that they are not accessible directly from the Internet.

• Ensure all nodes are always up to date in terms of installed software, operating system, and firmware patches as well as anti-virus and firewall.

• When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available.

More information on recommended practices can be found in the following documents:
HT0038 FBXi, CBXi and ASPECT® SOLUTIONS

General security recommendations

For additional instructions and support please contact your local ABB service organization. For contact
information, see www.abb.com/contactcenters.

Information about ABB’s cyber security program and capabilities can be found at www.abb.com/cybersecurity.

Support

The information in this document is subject to change without notice, and should not be construed as a
commitment by ABB.

ABB provides no warranty, express or implied, including warranties of merchantability and fitness for a
particular purpose, for the information contained in this document, and assumes no responsibility for
any errors that may appear in this document. In no event shall ABB or any of its suppliers be liable for direct, indirect, special, incidental or consequential damages of any nature or kind arising from the use of
this document, or from the use of any hardware or software described in this document, even if ABB or
its suppliers have been advised of the possibility of such damages.
This document and parts hereof must not be reproduced or copied without written permission from
ABB, and the contents hereof must not be imparted to a third party nor used for any unauthorized purpose.
All rights to registrations and trademarks reside with their respective owners ABB provides no warranty, express or implied, including warranties of merchantability and fitness for a particular purpose, for the information contained in this document, and assumes no responsibility for any errors that may appear in this document. In no event shall ABB or any of its suppliers be liable for direct, indirect, special, incidental or consequential damages of any nature or kind arising from the use of this document, or from the use of any hardware or software described in this document, even if ABB or its suppliers have been advised of the possibility of such damages.

This document and parts hereof must not be reproduced or copied without written permission from ABB, and the contents hereof must not be imparted to a third party nor used for any unauthorized purpose.

All rights to registrations and trademarks reside with their respective owners.

Notice

The vulnerabilities reported in scope of this document are only exploitable if attackers can access the network segment where FLXEON is installed and exposed directly to the internet.
ABB therefore recommends the following guidelines in order to protect customers networks:

• FLXEON devices should never be exposed directly to the Internet either via a direct ISP connection nor via NAT port forwarding. If remote access to a FLXEON system is a customer requirement, the system shall operate behind a firewall. Users accessing FLXEON remotely shall do this
using a VPN Gateway allowing access to the particular network segment where FLXEON is installed and configured.

• Note: it is crucial that the VPN Gateway and Network is setup in accordance with best industry
standards and maintained in terms of security patches for all related components.

• ABB System Integrators shall change default passwords if they are still in use.

• Ensure that all FLXEON products are upgraded to the latest firmware version. Please find the latest version of FLXEON firmware on the respective product homepage

Mitigating factors

Summary: ABB CYBERSECURITY ADVISORY - PDF version.

Summary: FBXi, CBXi and ASPECT® SOLUTIONS

Summary: ABB CYBERSECURITY ADVISORY - CSAF version.

FLXeon Controllers Multiple vulnerabilities

Summary: Initial version.

Summary: Publishing to public

Summary: Correction in manual advisory CVSS 4.0 score

Credentials that are required for the functioning of the product cannot be stored in a HW supported secure storage as the product does not implement such a component.

CVE Description

Summary: NVD -CVE-2024-48842

Follow Mitigating factors.

- Stop and disconnect any FLXEON products that are exposed directly to the Internet, either via a direct ISP connection or via NAT port forwarding.

- Ensure that physical controls are in place, so no unauthorized personnel can access your devices, components, peripheral equipment, and networks.

- Ensure that all FLXEON products are upgraded to the latest firmware version. Please find the latest version of FLXEON firmware on the respective product homepage.

- When remote access is required, only use secure methods. If a Virtual Private Network (VPN) is used, ensure that the chosen VPN is secure i.e. updated to the most current version available and
configured for secure access.

CVE-2024-48842

Improper Validation of Specified Type of Input

A remote code execution is possible due to an improper input validation.

CVE Description

Summary: NVD -CVE-2024-48851

CVE-2024-48851

Password hashes are stored using a vulnerable MD5 algorithm with low entropy on salt, stored in plain text on unencrypted partitions.

CVE Description

Summary: NVD -CVE-2025-10205

CVE-2025-10205

Users can push files with full pathnames allowing file operations in off limits directories.

CVE Description

Summary: NVD -CVE-2025-10207

CVE-2025-10207


ABB is aware of vulnerabilities in the product versions listed as affected in the advisory. A firmware update is available that resolves these privately reported vulnerabilities in the product versions listed as affected in the advisory.

An attacker who successfully exploited these vulnerabilities could access sensitive information stored inside the device and can change the configuration of the device .

Summary

Recommended security practices and firewall configurations can help protect a process control network from attacks that originate from outside the network. Such practices include that process control systems are physically protected from direct access by unauthorized personnel, have no direct connections to the Internet, and are separated from other networks by means of a firewall system that has a minimal number of ports exposed, and others that have to be evaluated case by case. Process control systems should not be used for Internet surfing, instant messaging, or receiving e-mails. Portable computers and removable storage media should be carefully scanned for viruses before they are connected to a control system.

More information on recommended practices can be found in the documents listed in the Reference section.

Mitigating factors

For any installation of software-related ABB products and especially for products in scope of the EIBPORT product line, we strongly recommend the following (non-exhaustive) list of cyber security practices:

•	Ensure that all EIBPORT products are upgraded to the latest firmware version. Please find the latest version of EIBPORT firmware on the respective product homepage.

•	Isolate special purpose networks (e.g. for automation systems) and remote devices behind firewalls and separate them from any general-purpose network (e.g. office or home networks).

•	Install physical controls so no unauthorized personnel can access your devices, components, peripheral equipment, and networks.

•	Never connect programming software or computers containing programming software to any network other than the network for the devices that it is intended for.

•	Scan all data imported into your environment before use to detect potential malware infections.

•	Minimize network exposure for all EIBPORT ports and endpoints to ensure that they are not accessible directly from the Internet.

•	Ensure all nodes are always up to date in terms of installed software, operating system, and firmware patches as well as anti-virus and firewall.

•	When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available.

•	Authorized users shall change all default credentials during commissioning of an EIBPORT system. If credentials have not been changed during commission state, ABB advises to change each changeable credential at the earliest.

More information on recommended practices can be found in the documents listed in the Reference section.

General security recommendations

The information in this document is subject to change without notice, and should not be construed as a commitment by ABB.

ABB provides no warranty, express or implied, including warranties of merchantability and fitness for a particular purpose, for the information contained in this document, and assumes no responsibility for any errors that may appear in this document. In no event shall ABB or any of its suppliers be liable for direct, indirect, special, incidental or consequential damages of any nature or kind arising from the use of this document, or from the use of any hardware or software described in this document, even if ABB or its suppliers have been advised of the possibility of such damages.

This document and parts hereof must not be reproduced or copied without written permission from ABB, and the contents hereof must not be imparted to a third party nor used for any unauthorized purpose.

All rights to registrations and trademarks reside with their respective owners.

Notice

For additional instructions and support please contact your local ABB service organization. For contact information, see www.abb.com/contactcenters.

Information about ABB’s cyber security program and capabilities can be found at www.abb.com/cybersecurity.

Support

ABB has a rigorous internal cyber security continuous improvement process which involves regular testing with industry leading tools and periodic assessments to identify potential product issues. Occasionally an issue is determined to be a design or coding flaw with implications that may impact product cyber security.

When a potential product vulnerability is identified or reported, ABB immediately initiates our vulnerability handling process. This entails validating if the issue is in fact a product issue, identifying root causes, determining what related products may be impacted, developing a remediation, and notifying end users and governmental organizations.

The resulting Cyber Security Advisory intends to notify customers of the vulnerability and provide details on which products are impacted, how to mitigate the vulnerability or explain workarounds that minimize the potential risk as much as possible. The release of a Cyber Security Advisory should not be misconstrued as an affirmation or indication of an active threat or ongoing campaign targeting the products mentioned here. If ABB is aware of any specific threats, it will be clearly mentioned in the communication.

The publication of this Cyber Security Advisory is an example of ABB’s commitment to the user community in support of this critical topic. Responsible disclosure is an important element in the chain of trust we work to maintain with our many customers. The release of an Advisory provides timely information which is essential to help ensure our customers are fully informed.

Purpose

What causes the vulnerability?

The session management of vulnerable FW versions of EIBPORT, fails to maintain a secure session management.

What is EIBPORT?

EIBPORT is a building management system allowing to automate buildings based on the KNX standards.

What might an attacker use the vulnerability to do?

An attacker who successfully exploited these vulnerabilities can gain access to the EIBPORT device without authenticating her-, himself.

Could the vulnerability be exploited remotely?

No, recommended practices include that building automation control systems are physically protected, have no direct connections to the Internet, and are separated from other networks by means of a firewall system that has a minimal number of ports exposed. Following these best practices, an attacker cannot exploit the vulnerability remotely. Unfortunately, ABB became aware that some customers have commissioned EIBPORT not according to these best practices but have made the IP address to the device accessible over the Internet or other untrusted networks. ABB emphasizes that this configuration is against the intended use of the system.

Can functional safety be affected by an exploit of this vulnerability?

No. EIBPORT is not designed as a functional safety device.

What does the update do?

The update removes the vulnerabilities by modifying the way that the device firmware verifies login credentials and token or session identifiers. Furthermore, it hardens the product configuration wherever possible.

When this security advisory was issued, had this vulnerability been publicly disclosed?

No, ABB had not received any information indicating that this vulnerability had been exploited when this security advisory was originally issued.

When this security advisory was issued, had ABB received any reports that this vulnerability was being exploited?

No, ABB had not received any information indicating that this vulnerability had been exploited when this security advisory was originally issued.

Frequently asked questions

Summary: Supplier of Firmware

Summary: Hardening guide for EIBPORT

Summary: System Manual 1

Summary: System Manual 2

EIBPORT Reflected XSS

Summary: Initial version

ABB

EIBPORT V3 KNX

EIBPORT V3 KNX (2CLA963710W1001) Version <3.9.2

EIBPORT V3 KNX (2CSM256242R2001) Version <3.9.2

EIBPORT V3 KNX GSM

EIBPORT V3 KNX GSM (2CLA963720W1001) version < 3.9.2

The vulnerability allows the successful attacker to receive a copy of the session id.

CVE Description

ABB recommends that customers apply the update at the earliest convenience.

CVE-2021-22291


ABB is aware of vulnerabilities in the product versions listed as affected in the advisory.

An attacker who successfully exploited this vulnerability could cause the pollution of heap memory which potentially takes remote control of the product and performs a write operation to the flash memory to alter the firmware behavior.

Summary

For additional instructions and support please contact your local ABB Digital Service Support ch.ups.digital@abb.com. For contact information, see ww.abb.com/contactcenters.

Information about ABB’s cyber security program and capabilities can be found at https://go.abb/cybersecurity.

Support

Notice

Summary: ABB CYBERSECURITY ADVISORY - PDF Version

Summary: ABB CYBERSECURITY ADVISORY - CSAF Version

Summary: ABB E-mobility, " Release notes Terra AC FW v1.8.34 JPN External," [Online]. Available:

Summary: ABB E-mobility, " BCM.V3Y01.0-JP Terra AC Installation Manual V006" [Online]. Available:

Terra AC wallbox Heap Memory Corruption Vulnerability

Summary: Initial version.

Summary: DocumentID update

Summary: Minor corrections

Summary: CVSS update

Summary: CVE update

Summary: CVE update

Summary: Fixed Version update

There is potential risk to pollute the memory when developing apps which is used to communicate with charger according to self-defined protocol if developers don’t strictly follow the field length which is not been validated in firmware.

CVE description

Summary: NVD - CVE-2025-10504

The problem is corrected in the following product version; apply the following update depending on product variant:

Terra AC wallbox (JP) 1.8.36
ABB recommends that customers apply the update at earliest convenience.

To attack with this kind of message, hackers must hijack Bluetooth first and then can send messages. Because the communication messages between BLE and charger have been encrypted. In theory, there is no way to attack the charger.

CVE-2025-10504

There is potential risk polluting the BSS memory when developing apps which is used to communicate with charger via Bluetooth according to self-defined protocol if developers configure an unexpected length of bin files.

CVE description

Summary: NVD - CVE-2025-12142

CVE-2025-12142

There is potential risk polluting the stack memory when developing a customized OCPP key of “Ran-domDelay“ in backend and configuring an unexpected number in the field.

CVE description

Summary: NVD - CVE-2025-12143

CVE-2025-12143