Source
ABB PSIRT
Source: https://global.abb/group/en/technology/cyber-security/alerts-and-notifications
84 results · Feed
-
High max 8.3
B&R PCs vulnerable to PixieFail attack
ABB became aware of vulnerability in the product versions listed as affected in the advisory. An update is now available that addresses and remediates the vulnerability. A network attacker could exploit the vulnerabilities to execute remote code, initiate DoS…
first Jan 29, 2026 -
Medium max 5.0
PVI Insertion of Sensitive Information into Logfile
ABB became aware of vulnerability in the product versions listed as affected in the advisory. An update is now available that addresses and remediates the vulnerability. An attacker who successfully exploited this vulnerability could read sensitive informatio…
first Jan 29, 2026 -
Critical max 7.5
B&R Automation Studio Update of SQLite version
ABB became aware of vulnerability in the product versions listed as affected in the advisory. An update is available that replaces an outdated third-party component. Although no successful exploitation was observed during testing of the affected B&R products,…
first Feb 18, 2026 -
Medium max 6.57PAA020125 1 CVE
Denial of Service Vulnerabilities in System 800xA, Symphony® Plus IEC 61850 communication stack
This vulnerability was privately reported relating to ABB’s implementation of the IEC 61850 communication stack for MMS client applications used in some Automation control system products. Note: IEC 61850 communication typically supports MMS and GOOSE protoco…
-
High max 8.87PAA017341 4 CVEs
PostgreSQL vulnerabilities in ABB Ability™ Symphony® Plus Engineering
ABB became aware of vulnerability in the products versions listed as affected in the advisory. The ABB S+ Engineering product versions are affected by vulnerabilities in PostgreSQL version 13.11 and earlier versions. If an attacker gains access to a site’s S+…
-
Critical max 7.54HZM000604 25 CVEs
ABB Ability Camera Connect Vulnerabilities in outdated 3rd party component (SQLite 3.2.4)
ABB is aware of public reports of vulnerabilities in a 3rd party dependency SQLite Version 3.2.4 which was delivered together with the installation package of Camera Connect Version 2.0.0.42 and below. An update is available that resolves a privately reported…
-
High max 8.34JNO000329 3 CVEs
AWIN Gateways Vulnerabilities in Embedded Webserver
ABB became aware of vulnerability in the products versions listed as affected in the advisory. An update is available that resolves the reported vulnerabilities. AWIN gateways are not intended to be internet-facing. An attacker who successfully exploited this…
-
Critical max 8.83ADR011536 1 CVE
AC500 V3 Stack buffer overflow in Cryptographic Message Syntax
ABB became aware of vulnerability in the products versions listed as affected in the advisory. An update is available that resolves publicly reported vulnerability. An attacker who successfully exploited these vulnerabilities could cause a crash, denial-of-se…
-
Medium max 5.33ADR011525 1 CVE
ABB Automation Builder Gateway for Windows with insecure defaults
ABB became aware of severe vulnerability in the products versions listed as affected in the advisory. The Windows gateway is accessible remotely by default. Unauthenticated attackers can therefore search for PLCs, but the user management of the PLCs prevents …
-
High max 8.33ADR011524 3 CVEs
AC500 V3 Multiple vulnerabilities
ABB became aware of severe vulnerability in the products versions listed as affected in the advisory. An update is available that resolves these vulnerabilities. An attacker who successfully exploited these vulnerabilities could bypass the user management and…
-
Medium max 5.7
System 800xA SECURITY Advisory - ABB 800xA Base 6.0.x, 6.1.x CSLib communication DoS vulnerability
ABB is aware of a vulnerability in the product versions listed as affected in the advisory. An attacker who successfully exploited this vulnerability could cause services to crash and restart by sending specifically crafted messages. The vulnerability only af…
first Jun 5, 2024 -
High max 8.19AKK108472A1331 1 CVE
ABB Ability™ OPTIMAX® Authentication Bypass in Single-Sign On with Azure Active Directory
ABB became aware of severe vulnerability in the products versions listed as affected in the advisory, if the optional integration with Azure Active Directory for Single-Sign On is enabled. We have not received any reports of this vulnerability being exploited…
-
High max 8.82CRT000009 3 CVEs
WebPro SNMP Card PowerValue Multiple Vulnerabilities
ABB became aware of multiple internally discovered vulnerabilities in the WebPro SNMP card PowerValue for the product versions listed as affected in the advisory. Depending upon the vulnerability, an attacker with access to local network who successfully expl…
-
Medium max 6.1
Terra AC wallbox Heap Memory Corruption Vulnerability
ABB is aware of vulnerabilities in the product versions listed as affected in the advisory. An attacker who successfully exploited this vulnerability could cause the pollution of heap memory which potentially takes remote control of the product and performs a…
first Sep 16, 2025 -
Critical max 8.0
ABB Ability Camera Connect Vulnerabilities in outdated 3rd party component (VLC)
ABB is aware of public reports of vulnerabilities in a 3rd party component VLC media player Version 2.2.4 which was delivered together with the installation package of Camera Connect Version 1.5.0.14 and below. An update is available that resolves a privately…
first Nov 27, 2025 -
Critical max 9.67PAA022088 1 CVE
Edgenius Management Portal Authentication Bypass
ABB identified a critical vulnerability present in ABB Ability Edgenius starting from version 3.2.0.0. We have not received any reports of this vulnerability being exploited. An unauthenticated attacker could exploit this vulnerability to: → install and run a…
-
Medium max 5.52NGA002813 1 CVE
PCM600 SharpZip library vulnerability
An update is available that resolves vulnerability in the product versions listed as affected in this advisory. An attacker who successfully exploited this vulnerability could insert and run arbitrary code in the system.
-
Critical max 10.0
ALS-mini-S4/S8 IP Missing Authentication Vulnerability and its Mitigations
ABB is aware of vulnerabilities in the product versions listed as affected in the advisory. An attacker who successfully exploited this vulnerability could cause the pollution of heap memory which potentially takes remote control of the product and performs a…
first Oct 20, 2025 -
Medium max 6.8
Terra AC wallbox Heap Memory Corruption Vulnerability
ABB is aware of vulnerabilities in the product versions listed as affected in the advisory. An attacker who successfully exploited this vulnerability could cause the pollution of heap memory which potentially takes remote control of the product and performs a…
first Oct 20, 2025 -
High max 7.1
CoreSense™ HM and CoreSense™ M10 File Path Traversal Vulnerability
An update is available that resolves vulnerability in the product versions listed as affected in this advisory. A path traversal vulnerability in these products can allow unauthenticated users to gain access to restricted directories. Exploiting this vulnerab…
first Apr 16, 2025 -
High max 7.44TZ00000006008 1 CVE
LVS MConfig Insecure memory handling
ABB became aware of an internally discovered vulnerability in the MConfig product versions listed as affected in the advisory. An attacker with access to local networks who successfully exploits vulnerability could have access to application’s sensitive infor…
-
High max 8.09AKK108471A7808 1 CVE
EIBPORT Reflected XSS
ABB is aware of vulnerabilities in the product versions listed as affected in the advisory. A firmware update is available that resolves these privately reported vulnerabilities in the product versions listed as affected in the advisory. An attacker who succe…
-
High max 8.8
FLXeon Controllers Multiple vulnerabilities
ABB is aware of vulnerabilities in the product versions listed as affected in the advisory. FLXEON devices are not intended to be internet-facing. A product advisory issued in June 2023 informed customers of this parameter. An attacker can successfully exploi…
first Sep 9, 2025 -
Critical max 9.8
ELSB/BLBA ASPECT advisory several CVEs
ABB became aware of vulnerabilities in ASPECT product versions listed as affected in the advisory. The earliest report dates to June 2023. ABB has fixed most of the vulnerabilities reported. At the moment there are no plans of corrective measures for remainin…
first Aug 11, 2025 -
High max 7.5
RMC - 100 Vulnerabilities in web UI (REST Interface)
ABB is aware of vulnerabilities in the product versions listed as affected in the advisory. An attacker who successfully exploited these vulnerabilities could gain unauthenticated access to the MQTT configu-ration data (CVE-2025-6074), cause a DoS on the MQTT…
first Jul 3, 2025 -
High max 7.8
ABB Automation Builder Vulnerabilities in user management and access control
ABB is aware of vulnerabilities in the product versions listed as affected in the following section. An attacker who successfully exploited this vulnerability could overrule the Automation Builder’s user management. Workarounds to close the vulnerabilities ar…
first Apr 30, 2025 -
Medium max 6.89AKK108471A4556 1 CVE
Busch-Welcome® 2 wire Door opener actuator by default in compatibility mode.
ABB is aware of vulnerabilities in the product versions listed as affected in the advisory. An attacker who successfully exploited this vulnerability could gain physical, unauthorized access to a Building where the product is installed
-
Medium max 6.72CRT000008 1 CVE
Lite Panel Pro Vulnerability in Session Management
ABB became aware of an internally discovered vulnerability in the Lite Panel Pro product listed as affected in the advisory. An attacker with access to local network who successfully exploits the vulnerability could have unauthorized access during a limited t…
-
Critical max 7.8
ELSB/Home Solutions Outdated SW Components in ABB Welcome IP-Gateway.
ABB became aware of vulnerabilities in IPGW product versions listed as affected in the advisory. An attacker who successfully exploits these vulnerabilities could potentially gain unauthorized access and potentially compromise the system's - and log-file - co…
first May 29, 2025 -
High max 8.8
EIBPORT Session Management Fail
ABB is aware of vulnerabilities in the product versions listed as affected in the advisory. A firmware update is available that resolves these privately reported vulnerabilities in the product versions listed as affected in the advisory. An attacker who succe…
first Jun 2, 2025 -
Critical max 9.1
ELSB/BLBA ASPECT advisory several CVEs
ABB became aware of vulnerabilities in ASPECT product versions listed as affected in the advisory. The earliest report dates to June 2023. ABB has fixed most of the vulnerabilities reported. At the moment there are no plans of corrective measures for remainin…
first May 22, 2025 -
High max 7.3
ANC – ABB Network Card Multiple vulnerabilities in ANC
An update is available that resolves internally discovered vulnerabilities in the product versions listed as affected in the advisory. Depending upon the vulnerability, an attacker with the access to the local network who successfully exploited this vulnerabi…
-
Medium max 7.52CRT000007 1 CVE
Ekip Com IEC61850 Vulnerability in 3rd Party Library
ABB is aware of public reports of a vulnerability in the product versions listed as affected in this advisory. An attacker who successfully exploited this vulnerability could cause the product to stop communicating on the IEC 61850 network.
-
High max 8.89AKK108470A9989 15 CVEs
ABB MV Drives Affected by CODESYS RTS (Runtime System) Vulnerabilities
Multiple vulnerabilities regarding the CODESYS Runtime System from CODESYS Group have been publicly reported. CODESYS Runtime System v.3.5.15.0 is utilized in the firmware of ABB MV ACS6080 and ACS5000 drives to provide IEC 61131 programming capabilities. The…
-
High max 8.12NGA002427 8 CVEs
ABB Arctic ARG600, ARC600, ARR600, ARP600 Arctic Wireless Gateway Modem Module and OpenSSH vulnerabilities
ABB is aware of public reports of the vulnerabilities in the product versions listed as affected in this advisory. An attacker who successfully exploited modem module vulnerabilities could run arbitrary code in the wireless modem module of the product. This c…
-
High max 9.82NGA002579 42 CVEs
ABB Arctic communication solution ARM600 Vulnerabilities
ABB is aware of public reports of a vulnerabilities in product versions listed as affected in this advisory. An attacker who successfully exploited these vulnerabilities could cause the product to stop, make the product inacces-sible, take remote control of t…
-
High max 8.8
ABB ACS880 +N8010 Drives CODESYS RTS Vulnerabilities
Multiple vulnerabilities regarding the CODESYS Runtime System from CODESYS Group have been publicly reported. CODESYS Runtime System is utilized in the firmware of ABB ACS880 drives to provide IEC 61131-3 programming capabilities. These vulnerabilities could …
first Mar 26, 2025 -
High max 8.8
Low Voltage DC Drives and Power Controllers CODESYS RTS Vulnerabilities
CODESYS group published several vulnerabilities regarding the CODESYS Runtime System, which is included in the firmware of ABB LV DC drives and power controllers. It is used to implement a selection of features and to provide IEC 611131-3 programming capabili…
first Mar 26, 2025 -
High max 7.59AKK108470A8565 1 CVE
RMC-100 Vulnerability in the Web UI (REST Interface)
An update is available that resolves a vulnerability in the product versions listed as affected in this advisory. An attacker who successfully exploited this vulnerability could cause the web UI to stop.
-
Critical max 10.0
FLXeon Controllers Cyber Security Advisory
An update is available that resolves a privately reported vulnerability in the product versions listed as affected in this advisory. FLXEON devices are not intended to be internet-facing. A product advisory issued in June 2023 informed customers of this param…
first Jan 20, 2025