{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE"
      }
    },
    "lang": "En",
    "notes": [
      {
        "category": "summary",
        "text": "ABB is aware of public reports of a vulnerability in the product versions listed as affected in this advisory.\nAn attacker who successfully exploited this vulnerability could cause the product to stop communicating on the IEC 61850 network.\n",
        "title": "Summary"
      },
      {
        "category": "other",
        "text": "For additional instructions and support please contact your local ABB service organization. For contact information, see www.abb.com/contactcenters.\nInformation about ABB\u2019s cyber security program and capabilities can be found at www.abb.com/cybersecurity.\n",
        "title": "Support"
      },
      {
        "category": "other",
        "text": "For any installation of software-related ABB products we strongly recommend the following (non-exhaustive) list of cyber security practices:\n\u2013\tIsolate special purpose networks (e.g. for automation systems) and remote devices behind firewalls and separate them from any general-purpose network (e.g. office or home networks).\n\u2013\tInstall physical controls so no unauthorized personnel can access your devices, components, peripheral equipment, and networks.\n\u2013\tNever connect programming software or computers containing programing software to any net-work other than the network for the devices that it is intended for.\n\u2013\tScan all data imported into your environment before use to detect potential malware infections.\n\u2013\tMinimize network exposure for all applications and endpoints to ensure that they are not accessible from the Internet unless they are designed for such exposure and the intended use requires such.\n\u2013\tEnsure all nodes are always up to date in terms of installed software, operating system, and firmware patches as well as anti-virus and firewall.\n\u2013\tWhen remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.\n",
        "title": "General security recommendations"
      },
      {
        "category": "legal_disclaimer",
        "text": "The information in this document is subject to change without notice, and should not be construed as a commitment by ABB.\nABB provides no warranty, express or implied, including warranties of merchantability and fitness for a particular purpose, for the information contained in this document, and assumes no responsibility for any errors that may appear in this document. In no event shall ABB or any of its suppliers be liable for direct, indirect, special, incidental or consequential damages of any nature or kind arising from the use of this document, or from the use of any hardware or software described in this document, even if ABB or its suppliers have been advised of the possibility of such damages.\nThis document and parts hereof must not be reproduced or copied without written permission from ABB, and the contents hereof must not be imparted to a third party nor used for any unauthorized purpose.\nAll rights to registrations and trademarks reside with their respective owners.\n",
        "title": "Notice"
      },
      {
        "category": "general",
        "text": "Mitigating factors describe conditions and circumstances that make an attack that exploits the vulnerability difficult or less likely to succeed. \nIn case customer cannot opt for not to upgrade the firmware or it is not feasible then please immediately apply mitigating factors mentioned in \u201cGeneral security recommendations\u201d.",
        "title": "Mitigating factors"
      }
    ],
    "publisher": {
      "category": "vendor",
      "name": "ABB PSIRT",
      "namespace": "https://global.abb/group/en/technology/cyber-security/alerts-and-notifications"
    },
    "references": [
      {
        "category": "self",
        "summary": "ABB CYBERSECURITY ADVISORY - PDF version",
        "url": "https://search.abb.com/library/Download.aspx?DocumentID=2CRT000007\u0026LanguageCode=en\u0026DocumentPartId=pdf\u0026Action=Launch"
      },
      {
        "category": "self",
        "summary": "ABB CYBERSECURITY ADVISORY - CSAF version",
        "url": "https://psirt.abb.com/csaf/2025/2crt000007.json"
      }
    ],
    "title": "Ekip Com IEC61850 Vulnerability in 3rd Party Library",
    "tracking": {
      "current_release_date": "2025-04-29T00:30:00.000Z",
      "generator": {
        "date": "2025-09-23T15:08:55.897Z",
        "engine": {
          "name": "Secvisogram",
          "version": "2.5.35"
        }
      },
      "id": "2CRT000007",
      "initial_release_date": "2025-04-29T00:30:00.000Z",
      "revision_history": [
        {
          "date": "2025-04-29T00:30:00.000Z",
          "legacy_version": "A",
          "number": "1",
          "summary": "Initial"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c3.08",
                "product": {
                  "name": "Ekip Com IEC61850 \u003c 3.08",
                  "product_id": "AV1"
                }
              },
              {
                "category": "product_version",
                "name": "3.08",
                "product": {
                  "name": "Ekip Com IEC61850 version 3.08",
                  "product_id": "FX1"
                }
              }
            ],
            "category": "product_name",
            "name": "Ekip Com IEC61850"
          }
        ],
        "category": "vendor",
        "name": "ABB"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2022-38138",
      "cwe": {
        "id": "CWE-824",
        "name": "Access of Uninitialized Pointer"
      },
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability exists in the 3rd party library included in the product versions listed as affected in this advisory. An attacker could exploit the vulnerability by sending a specially crafted message to the system node, causing the node to stop or become inaccessible.",
          "title": "CVE Description"
        }
      ],
      "product_status": {
        "fixed": [
          "FX1"
        ],
        "known_affected": [
          "AV1"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "NVD CVE-2022-38138",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-38138"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "The problem is corrected in the product versions:\nEkip Com IEC61850 version 3.08 \nABB advises users of the affected product versions to reach out to their local ABB support team for guidance and recommended actions.\nAdditionally, ABB recommends implementing defensive measures to reduce the risk of vulnerability exploitation, as outlined in the product instruction manual. Please refer to the section \u201cMitigation factors\u201d for more information.\n",
          "product_ids": [
            "AV1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "environmentalScore": 6,
            "environmentalSeverity": "MEDIUM",
            "exploitCodeMaturity": "FUNCTIONAL",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "remediationLevel": "OFFICIAL_FIX",
            "reportConfidence": "CONFIRMED",
            "scope": "UNCHANGED",
            "temporalScore": 6,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:F/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "AV1"
          ]
        }
      ],
      "title": "CVE-2022-38138 "
    }
  ]
}