Summary
ABB became aware of severe vulnerability in the products versions listed as affected in the advisory.
The Windows gateway is accessible remotely by default. Unauthenticated attackers can therefore search for PLCs, but the user management of the PLCs prevents the actual access to the PLCs – unless it is disabled
Vulnerabilities 1
-
Medium 5.3
CODESYS (Edge) Gateway for Windows insecure default
An unauthenticated remote attacker can gain limited information of the PLC network but the user management of the PLCs prevents the actual access to the PLCs.
Revision history
-
#2
Initial CISA Republication of ABB PSIRT 3ADR011525 advisory
-
#1
Initial version.
References
-
ABB CYBERSECURITY ADVISORY - PDF Version
https://search.abb.com/library/Download.aspx?DocumentID=3ADR011525&LanguageCode=en&DocumentPartId=&Action=Launch
-
2025-02: CODESYS (Edge) Gateway for Windows insecure default
https://api-de.codesys.com/fileadmin/user_upload/CODESYS_Group/Ecosystem/Up-to-Date/Security/Security-Advisories/Advisory2025-02_CDS-90834.pdf
-
ICS Advisory ICSA-26-132-04 - Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-26-132-04
-
Recommended Practices
https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01
-
Recommended Practices
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
-
Recommended Practices
https://www.cisa.gov/topics/industrial-control-systems
-
Recommended Practices
https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
-
Recommended Practices
https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
-
Recommended Practices
https://www.cisa.gov/news-events/news/targeted-cyber-intrusion-detection-and-mitigation-strategies-update-b