Summary
ABB is aware of vulnerabilities in the product versions listed as affected in the advisory.
FLXEON devices are not intended to be internet-facing. A product advisory issued in June 2023 informed
customers of this parameter.
An attacker can successfully exploit these vulnerabilities and could take remote control of the product
and potentially insert and run arbitrary code.
ABB requires, as noted in previous security advisories and user documentation, that FLXEON should not be exposed to the internet or any other insecure network.
Note: In order to exploit an FLXEON, an attacker would need a misconfigured system.
ABB strongly advises customers and system integrators to follow the instructions documented in: FBXi,
CBXi and ASPECT® SOLUTIONS, which can be downloaded from the ABB library.
Vulnerabilities 4
-
High 8.8
Predictable Salt and Weak Hashing Algorithm
Use of a One-Way Hash with a Predictable Salt vulnerability in ABB FLXEON.This issue affects FLXEON: through 9.3.5. and newer versions
-
High 7.2
Remote Code Execution
Improper Validation of Specified Type of Input vulnerability in ABB FLXEON.A remote code execution is possible due to an improper input validation. This issue affects FLXEON: through 9.3.5.
-
High 7.2
Authenticated File Disclosure/Delete
Improper Validation of Specified Type of Input vulnerability in ABB FLXEON.This issue affects FLXEON: through 9.3.5.
-
High 7.0
Hardcoded passwords
Use of Hard-coded Credentials vulnerability in ABB FLXEON.This issue affects FLXEON: through 9.3.5 and newer versions
Revision history
-
#3
Correction in manual advisory CVSS 4.0 score
-
#2
Publishing to public
-
#1
Initial version.
References
-
ABB CYBERSECURITY ADVISORY - PDF version.
https://search.abb.com/library/Download.aspx?DocumentID=9AKK108471A7121&LanguageCode=en&DocumentPartId=pdf&Action=Launch
-
FBXi, CBXi and ASPECT® SOLUTIONS
https://search.abb.com/library/Download.aspx?DocumentID=HT0038&LanguageCode=en&DocumentPartId=&Action=Launch