Summary
An update is available that resolves a privately reported vulnerability in the product versions listed as affected in this advisory.
FLXEON devices are not intended to be internet-facing. A product advisory issued in June 2023 informed customers of this parameter.
An attacker can successfully exploit these vulnerabilities and could take remote control of the product and potentially insert and run arbitrary code.
ABB requires, as noted in previous security advisories and user documentation, that FLXEON should not be exposed to the internet or any other insecure network.
Note: In order to exploit an FLXEON, an attacker would need a misconfigured system.
ABB strongly advises customers and system integrators to follow the instructions documented in: FBXi, CBXi and ASPECT® SOLUTIONS, which can be downloaded from the ABB library (See in the reference section).
Vulnerabilities 3
-
Critical 10.0CVE-2024-48841 Public exploit
Remote Code Execution (RCE) Vulnerabilities
Network access can be used to execute arbitrary code with elevated privileges. This issue affects FLXEON 9.3.4 and older.
-
Critical 9.4CVE-2024-48849 Public exploit
Authentication and Authorization Issues
Missing Origin Validation in WebSockets vulnerability in FLXEON. Session management was not sufficient to prevent unauthorized HTTPS requests. This issue affects FLXEON: through <= 9.3.4.
-
Critical 9.4CVE-2024-48852 Public exploit
Information disclosures
Insertion of Sensitive Information into Log File vulnerability observed in FLEXON. Some information may be improperly disclosed through https access. This issue affects FLXEON through <= 9.3.4.
Revision history
-
#7
CWE value and description corrected
-
#5
Resolved minor fixes.
-
#6
Fix copyright year and CVSS value
-
#4
CVE-2024-48841, corrected severity
-
#1
Initial version
-
#2
Fixing file name
-
#3
Fixing page formatting
References
-
ABB CYBERSECURITY ADVISORY - PDF version
https://search.abb.com/library/Download.aspx?DocumentID=9AKK108470A5684&LanguageCode=en&DocumentPartId=PDF&Action=Launch
-
FBXi, CBXi and ASPECT® SOLUTIONS (HT0038)
https://search.abb.com/library/Download.aspx?DocumentID=HT0038&LanguageCode=en&DocumentPartId=&Action=Launch