Description
An attacker who successfully exploited these vulnerabilities could cause enable command execution. A vulnerability exists in the AC500 V3 version mentioned. After successfully exploiting CVE-2024-12429 (directory traversal), a successfully authenticated attacker can inject arbitrary commands into a specifically crafted file, which then will be executed by root user.
All AC500 V3 products (PM5xxx) with firmware version earlier than 3.8.0 are affected by this vulnerability.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| ABB | AC500 V3 | < 3.8.0 | 3.8.0 |
Advisories 2
- WID-SEC-2025-0023 ABB AC-500: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 7, 2025
- 3ADR011377 AC500 V3 Multiple vulnerabilities ABB PSIRT · Jan 7, 2025