Skip to content
OpenAdvisories
Critical ICSA-25-051-02 3 CVEs

ABB FLXEON Controllers

Published Jan 23, 2025 · Updated Feb 14, 2025 · Revision 3

Vendor: ABB Product: FBXi

Summary

An update is available that resolves a privately reported vulnerability in the product versions listed as affected in this advisory.

FLXEON devices are not intended to be internet-facing. A product advisory issued in June 2023 informed customers of this parameter.

An attacker can successfully exploit these vulnerabilities and could take remote control of the product and potentially insert and run arbitrary code.
ABB requires, as noted in previous security advisories and user documentation, that FLXEON should not be exposed to the internet or any other insecure network.
Note: In order to exploit an FLXEON, an attacker would need a misconfigured system.

ABB strongly advises customers and system integrators to follow the instructions documented in: FBXi, CBXi and ASPECT® SOLUTIONS, which can be downloaded from the ABB library (See in the reference section).

Vulnerabilities 3

  • Critical 10.0
    CVE-2024-48841 Public exploit

    Remote Code Execution (RCE) Vulnerabilities

    Network access can be used to execute arbitrary code with elevated privileges. This issue affects FLXEON 9.3.4 and older.

    ABB FLXEON ICS / OT
  • Critical 9.4
    CVE-2024-48849 Public exploit

    Authentication and Authorization Issues

    Missing Origin Validation in WebSockets vulnerability in FLXEON. Session management was not sufficient to prevent unauthorized HTTPS requests. This issue affects FLXEON: through <= 9.3.4.

    ABB FLXEON ICS / OT
  • Critical 9.4
    CVE-2024-48852 Public exploit

    Information disclosures

    Insertion of Sensitive Information into Log File vulnerability observed in FLEXON. Some information may be improperly disclosed through https access. This issue affects FLXEON through <= 9.3.4.

    ABB FLXEON ICS / OT

Revision history

  1. #1.1.1

    Correction in CWE on CVE-2024-48841

  2. #1.1.0

    Typo error corrections

  3. #1.0.0

    Initial version

References