ABB became aware of vulnerability in the products versions listed as affected in the advisory. An update is available that resolves publicly reported vulnerability. An attacker who successfully exploited these vulnerabilities could cause a crash, denial-of-service (DoS), or potentially remote code execution.
\n
The following versions of ABB AC500 V3 Stack Buffer Overflow in Cryptographic Message Syntax are affected:
\n
\n
AC500 V3 PM5xxx 3.9.0, 3.9.0_HF1
\n
\n
\n
\n\n
\n
CVSS
\n
Vendor
\n
Equipment
\n
Vulnerabilities
\n
\n\n\n
\n
v3 9.8
\n
ABB
\n
ABB AC500 V3 Stack Buffer Overflow in Cryptographic Message Syntax
\n
Out-of-bounds Write
\n
\n\n
\n
\n
Background
\n
\n
Critical Infrastructure Sectors: Chemical, Critical Manufacturing, Energy, Water and Wastewater
When parsing CMS (Auth)EnvelopedData structures that use AEAD ciphers such as AES-GCM, the IV (Initialization Vector) encoded in the ASN.1 parameters is copied into a fixed-size stack buffer without verifying that its length fits the destination. An attacker can supply a crafted CMS message with an oversized IV, causing a stack-based out-of-bounds write before any authentication or tag verification occurs. Because the overflow occurs prior to authentication, no valid key material is required to trigger it. While exploitability to remote code execution depends on platform and toolchain mitigations, the stack-based write primitive represents a severe risk.
ABB AC500 V3 Stack Buffer Overflow in Cryptographic Message Syntax
\n
\n
Vendor: ABB
\n
Product Version: ABB AC500 V3 PM5xxx Firmware Version 3.9.0
\n
Product Status: fixed, known_affected
\n
\n
\n
Remediations
\n
Vendor fix The problem is corrected in the following product version: - AC500 V3 firmware version 3.9.0 HF1 ABB recommends that customers apply the update at earliest convenience. This firmware version is released for all AC500 V3 PLC types and available for download from the ABB library. https://search.abb.com/library/Download.aspx?DocumentID=3ADR011537&LanguageCode=en&DocumentPartId=&Action=Launch
\n
Mitigation Refer to section \u201cGeneral security recommendations\u201d for further advise on how to keep your system secure.
The information in this document is subject to change without notice, and should not be construed as a commitment by ABB. ABB provides no warranty, express or implied, including warranties of merchantability and fitness for a particular purpose, for the information contained in this document, and assumes no responsibility for any errors that may appear in this document. In no event shall ABB or any of its suppliers be liable for direct, indirect, special, incidental or consequential damages of any nature or kind arising from the use of this document, or from the use of any hardware or software described in this document, even if ABB or its suppliers have been advised of the possibility of such damages. This document and parts hereof must not be reproduced or copied without written permission from ABB, and the contents hereof must not be imparted to a third party nor used for any unauthorized purpose. All rights to registrations and trademarks reside with their respective owners.
\n\n
Frequently Asked Questions
\n
What causes the vulnerability? - Parsing CMS AuthEnvelopedData or EnvelopedData message with maliciously crafted AEAD parameters can trigger a stack buffer overflow. What is AC500 V3? - The AC500 V3 is a scalable range of Programmable Logic Controller (PLC). It provides solutions for small, medium and high-end applications. The AC500 V3 platform offers different performance levels and is the ideal choice for high availability, extreme environments, condition monitoring, motion control or safety solutions. It offers interoperability and compatibility in hardware and software from compact PLCs up to high end and safety PLCs. What might an attacker use the vulnerability to do? - An attacker who successfully exploited these vulnerabilities could cause a crash, denial-of-service (DoS), or potentially remote code execution. How could an attacker exploit the vulnerability? - Refer to section \u201cVulnerability severity and details\u201c. Could the vulnerability be exploited remotely? - Yes, an attacker who has network access to an affected system node could exploit the vulnerabilities. Recommended practices include that process control systems are physically protected, have no direct connections to the Internet, and are separated from other networks by means of a firewall system that has a minimal number of ports exposed. When this security advisory was issued, had this vulnerability been publicly disclosed? - Yes, the vulnerabilities have been publicly disclosed. When this security advisory was issued, had ABB received any reports that this vulnerability was being exploited? - No, ABB had not received any information indicating that this vulnerability had been exploited when this security advisory was originally issued.
\n\n
Legal Notice and Terms of Use
\n
This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
\n\n
Recommended Practices
\n
CISA recommends users take defensive measures to minimize the exploitation risk of these vulnerabilities.
\n
Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.
\n
Locate control system networks and remote devices behind firewalls and isolate them from business networks.
\n
When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.
\n
CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
\n
CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
\n
CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
\n
Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
\n\n
Advisory Conversion Disclaimer
\n
This ICSA is a verbatim republication of ABB PSIRT 3ADR011536 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided \"as-is\" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact ABB PSIRT directly for any questions regarding this advisory.
\n
Revision History
\n
\n
Initial Release Date: 2026-03-12
\n
\n
\n\n
\n
Date
\n
Revision
\n
Summary
\n
\n\n\n
\n
2026-03-12
\n
1
\n
Initial version.
\n
\n
\n
2026-05-12
\n
2
\n
Initial CISA Republication of ABB PSIRT 3ADR011536 advisory
PowerSYSTEM Center REST API endpoint for device account export allows an authenticated user with limited permissions to expose sensitive information normally restricted to administrative permissions only.
Product Version: Subnet Solutions Inc. PowerSYSTEM Center 2020: >=5.8.x|<=5.28.x, Subnet Solutions Inc. PowerSYSTEM Center 2024: >=6.0.x|<=6.1.x, Subnet Solutions Inc. PowerSYSTEM Center 2026: 7.0.x
\n
Product Status: known_affected
\n
\n
\n
Remediations
\n
Mitigation Subnet Solutions recommends users update to the latest version of PowerSYSTEM Center PSC 2020 Update 29, PSC 2024 Update 2, and PSC 2026 GA Hotfix.
\n
Mitigation For assistance in upgrading, users should contact a Subnet Solutions System Integration team member or customer support team at (403) 270-8885 or by email at support@subnet.com. mailto:support@subnet.com
\n
Mitigation Subnet Solutions recommends users do the following in order to reduce risk: Monitor user activity records to ensure users are following acceptable usage policies of the application. Restrict access to Notification Settings to trusted Administrators Monitor \"Send from Address\" in settings and Activity Records. Configure a notification rule that triggers in any bulk account export activity.
PowerSYSTEM Center REST API endpoint for devices allows a low privilege authenticated user to access information normally limited by operational permissions.
Product Version: Subnet Solutions Inc. PowerSYSTEM Center 2020: >=5.11.x|<=5.28.x
\n
Product Status: known_affected
\n
\n
\n
Remediations
\n
Mitigation Subnet Solutions recommends users update to the latest version of PowerSYSTEM Center PSC 2020 Update 29, PSC 2024 Update 2, and PSC 2026 GA Hotfix.
\n
Mitigation For assistance in upgrading, users should contact a Subnet Solutions System Integration team member or customer support team at (403) 270-8885 or by email at support@subnet.com. mailto:support@subnet.com
\n
Mitigation Subnet Solutions recommends users do the following in order to reduce risk: Monitor user activity records to ensure users are following acceptable usage policies of the application. Restrict access to Notification Settings to trusted Administrators Monitor \"Send from Address\" in settings and Activity Records. Configure a notification rule that triggers in any bulk account export activity.
PowerSYSTEM Center feature for device project groups allows an authenticated user with limited permissions to perform an unauthorized deletion of project groups.
Product Version: Subnet Solutions Inc. PowerSYSTEM Center 2024: >=6.0.x|<=6.1.x, Subnet Solutions Inc. PowerSYSTEM Center 2026: 7.0.x
\n
Product Status: known_affected
\n
\n
\n
Remediations
\n
Mitigation Subnet Solutions recommends users update to the latest version of PowerSYSTEM Center PSC 2020 Update 29, PSC 2024 Update 2, and PSC 2026 GA Hotfix.
\n
Mitigation For assistance in upgrading, users should contact a Subnet Solutions System Integration team member or customer support team at (403) 270-8885 or by email at support@subnet.com. mailto:support@subnet.com
\n
Mitigation Subnet Solutions recommends users do the following in order to reduce risk: Monitor user activity records to ensure users are following acceptable usage policies of the application. Restrict access to Notification Settings to trusted Administrators Monitor \"Send from Address\" in settings and Activity Records. Configure a notification rule that triggers in any bulk account export activity.
Product Version: Subnet Solutions Inc. PowerSYSTEM Center 2020: <=5.28.x, Subnet Solutions Inc. PowerSYSTEM Center 2024: >=6.0.x|<=6.1.x, Subnet Solutions Inc. PowerSYSTEM Center 2026: 7.0.x
\n
Product Status: known_affected
\n
\n
\n
Remediations
\n
Mitigation Subnet Solutions recommends users update to the latest version of PowerSYSTEM Center PSC 2020 Update 29, PSC 2024 Update 2, and PSC 2026 GA Hotfix.
\n
Mitigation For assistance in upgrading, users should contact a Subnet Solutions System Integration team member or customer support team at (403) 270-8885 or by email at support@subnet.com. mailto:support@subnet.com
\n
Mitigation Subnet Solutions recommends users do the following in order to reduce risk: Monitor user activity records to ensure users are following acceptable usage policies of the application. Restrict access to Notification Settings to trusted Administrators Monitor \"Send from Address\" in settings and Activity Records. Configure a notification rule that triggers in any bulk account export activity.
Kelly Stich of Subnet Solutions Inc reported these vulnerabilities to CISA
\n
\n\n
Legal Notice and Terms of Use
\n
This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
\n\n
Recommended Practices
\n
CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities.
\n
Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the Internet.
\n
Locate control system networks and remote devices behind firewalls and isolating them from business networks.
\n
When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.
\n
CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
\n
CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
\n
CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.
\n
Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
\n
Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
\n
CISA also recommends users take the following measures to protect themselves from social engineering attacks:
\n
Do not click web links or open attachments in unsolicited email messages.
\n
Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.
\n
Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.
\n
No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time. These vulnerabilities are not exploitable remotely.
\n\n
Revision History
\n
\n
Initial Release Date: 2026-05-12
\n
\n
\n\n
\n
Date
\n
Revision
\n
Summary
\n
\n\n\n
\n
2026-05-12
\n
1
\n
Initial Publication
\n
\n\n
\n\n
Legal Notice and Terms of Use
",
"summary_is_html": true,
"first_seen": "Tue, 12 May 26 12:00:00 +0000",
"last_updated": "Tue, 12 May 26 12:00:00 +0000"
},
{
"id": "https://www.cisa.gov/resources-tools/resources/software-bill-materials-ai-minimum-elements",
"title": "Software Bill of Materials for AI - Minimum Elements",
"source": "CISA Cybersecurity Advisory",
"source_url": "https://www.cisa.gov/resources-tools/resources/software-bill-materials-ai-minimum-elements",
"summary": "
CISA and the Group of Seven (G7) international partners\u2014Germany, Canada, France, Italy, Japan, the United Kingdom, and the European Union\u2014have released joint guidance, Software Bill of Materials for AI \u2013 Minimum Elements, to help public and private sector stakeholders improve transparency in their artificial intelligence (AI) systems and supply chains.
\n
A software bill of materials (SBOM) acts as an \u201cingredients list\u201d for software that better positions organizations to understand their supply chains and make risk-informed decisions about how to protect their critical systems. The guidance builds on CISA\u2019s previous work with federal and international partners to establish a shared vision for a software bill of materials and provides recommendations on minimum elements that should be included in an SBOM for AI. Because AI systems are software systems, these recommendations should be considered in addition to the general minimum elements for an SBOM.
\n
While not exhaustive or mandatory, the supplemental minimal elements outlined in this guidance reflect the consensus of G7 experts and will expand over time to keep pace with the rapid advancement of AI technology.
ABB became aware of multiple internally discovered vulnerabilities in the WebPro SNMP card PowerValue for the product versions listed as affected in the advisory. Depending upon the vulnerability, an attacker with access to local network who successfully exploited this vulnerability could have - Unauthorized access - Insufficient Session Expiration leading to resource unavailability - Uncontrolled Resource Consumption leading to DOS attack ABB strongly advises customers to update the latest firmware of affected products.
\n
The following versions of ABB WebPro SNMP Card PowerValue Multiple Vulnerabilities are affected:
Improper Check for Unusual or Exceptional Conditions, Incorrect Implementation of Authentication Algorithm, Insufficient Session Expiration
\n
\n\n
\n
\n
Background
\n
\n
Critical Infrastructure Sectors: Chemical, Communications, Critical Manufacturing, Dams, Energy, Healthcare and Public Health, Information Technology, Water and Wastewater
Modus(slave) protocol was implemented incorrectly in the device, port 502 becomes unstable and Modbus service is unavailable until manual reboot of the device.
Vendor fix The problem is corrected in the following product versions: WebPro SNMP card PowerValue version 1.1.8.p ABB advises users of the affected product versions to reach out to ABB Digital Service Support (ch.ups.digital@abb.com) for guidance and recommended actions. Additionally, ABB recommends implementing defensive measures to reduce the risk of vulnerability exploitation, as outlined in the product instruction manual. Please refer to the section \u201cMitigation factors\u201d for more information.
\n
Mitigation Mitigating factors describe conditions and circumstances that make an attack that exploits the vulnerability difficult or less likely to succeed. In case customer cannot opt for not to upgrade the firmware or it is not feasible then please immediately apply mitigating factors mentioned in \u201cGeneral security recommendations\u201d.
Device web HMI authenticates user by validating the first character of the session cookie and authentication token. So, if only the first characters of the session cookie and token are correct, a user will be validated. An attacker can easily brute force the first character of both session cookie and bearer token. This vulnerability allows an attacker to easily bypass the authentication implemented on the device.
Vendor fix The problem is corrected in the following product versions: WebPro SNMP card PowerValue version 1.1.8.p ABB advises users of the affected product versions to reach out to ABB Digital Service Support (ch.ups.digital@abb.com) for guidance and recommended actions. Additionally, ABB recommends implementing defensive measures to reduce the risk of vulnerability exploitation, as outlined in the product instruction manual. Please refer to the section \u201cMitigation factors\u201d for more information.
\n
Mitigation Mitigating factors describe conditions and circumstances that make an attack that exploits the vulnerability difficult or less likely to succeed. In case customer cannot opt for not to upgrade the firmware or it is not feasible then please immediately apply mitigating factors mentioned in \u201cGeneral security recommendations\u201d.
Idle session timeout is not configured for port 23 and 502 in device, due to which an attacker can make number of connections to the device and since device is not destroying the connections, it can lead to unavailability of the resources from the device.
Vendor fix The problem is corrected in the following product versions: WebPro SNMP card PowerValue version 1.1.8.p ABB advises users of the affected product versions to reach out to ABB Digital Service Support (ch.ups.digital@abb.com) for guidance and recommended actions. Additionally, ABB recommends implementing defensive measures to reduce the risk of vulnerability exploitation, as outlined in the product instruction manual. Please refer to the section \u201cMitigation factors\u201d for more information.
\n
Mitigation Mitigating factors describe conditions and circumstances that make an attack that exploits the vulnerability difficult or less likely to succeed. In case customer cannot opt for not to upgrade the firmware or it is not feasible then please immediately apply mitigating factors mentioned in \u201cGeneral security recommendations\u201d.
The information in this document is subject to change without notice, and should not be construed as a commitment by ABB. ABB provides no warranty, express or implied, including warranties of merchantability and fitness for a particular purpose, for the information contained in this document, and assumes no responsibility for any errors that may appear in this document. In no event shall ABB or any of its suppliers be liable for direct, indirect, special, incidental or consequential damages of any nature or kind arising from the use of this document, or from the use of any hardware or software described in this document, even if ABB or its suppliers have been advised of the possibility of such damages. This document and parts hereof must not be reproduced or copied without written permission from ABB, and the contents hereof must not be imparted to a third party nor used for any unauthorized purpose. All rights to registrations and trademarks reside with their respective owners.
\n\n
Frequently Asked Questions
\n
What causes the vulnerability? - The vulnerabilities are caused by code defects allowing the attacker to do various unintended, unauthorized actions on the target device. Please look at the description of the respective vulnerabilities in section \u201cVulnerability severity and details\u201d for further details. What is WebPro SNMP Card PowerValue? - The WebPro SNMP Card PowerValue provide web server to monitor and manage multiple UPS products in networked environment. It can detect temperature and humidity for the environment via connecting to EMD (Environmental Monitoring Device). It can not only prevent data loss from power outage and safely shutdown systems but also store programming data and scheduled shut down the UPS. All UPS warning and fault event records can be kept in WebPro SNMP Card PowerValue. What might an attacker use the vulnerability to do? - If mentioned vulnerabilities have been successfully exploited by an attacker, this could allow the attacker to take control of the target WebPro SNMP Card PowerValue device. How could an attacker exploit the vulnerability? - An attacker could try to exploit the vulnerability by creating a specially crafted message and sending the message to WebPro SNMP Card PowerValue device. This would require that the attacker has access to the system network, by connecting to the network either directly or through a wrongly configured or penetrated security system. Could the vulnerability be exploited remotely? - Yes, an attacker who has network access to an affected system node could exploit this vulnerability. Recommended practices include that User\u2019s network systems are physically protected, have no direct connections to the Internet nor any other untrusted network, and are separated from other networks by means of a firewall system that has a minimal number of ports exposed. What does the update do? - WebPro SNMP Card PowerValue v1.1.8.p update has fixes for all the vulnerabilities mentioned in \u201cVulnerability severity and details\u201d section. When this security advisory was issued, had this vulnerability been publicly disclosed? - No, the vulnerabilities have not been publicly disclosed. When this security advisory was issued, had ABB received any reports that this vulnerability was being exploited? - No, ABB had not received any information indicating that this vulnerability had been exploited when this security advisory was originally issued.
\n\n
Legal Notice and Terms of Use
\n
This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
\n\n
Recommended Practices
\n
CISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability.
\n
Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.
\n
Locate control system networks and remote devices behind firewalls and isolate them from business networks.
\n
When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.
\n
CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
\n
CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
\n
CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
\n
Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
\n\n
Advisory Conversion Disclaimer
\n
This ICSA is a verbatim republication of ABB PSIRT 2CRT000009 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided \"as-is\" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact ABB PSIRT directly for any questions regarding this advisory.
\n
Revision History
\n
\n
Initial Release Date: 2026-01-07
\n
\n
\n\n
\n
Date
\n
Revision
\n
Summary
\n
\n\n\n
\n
2026-01-07
\n
1
\n
Initial version.
\n
\n
\n
2026-05-12
\n
2
\n
Initial CISA Republication of ABB PSIRT 2CRT000009 advisory
ABB became aware of severe vulnerability in the products versions listed as affected in the advisory. An update is available that resolves these vulnerabilities. An attacker who successfully exploited these vulnerabilities could bypass the user management and read visualization files (CVE-2025-2595), read and write certificates and keys (CVE-2025-41659) or cause a denial-of-service (DoS) (CVE-2025-41691).
\n
The following versions of ABB AC500 V3 Multiple Vulnerabilities are affected:
\n
\n
AC500 V3 <3.9.0, 3.9.0
\n
\n
\n
\n\n
\n
CVSS
\n
Vendor
\n
Equipment
\n
Vulnerabilities
\n
\n\n\n
\n
v3 8.3
\n
ABB
\n
ABB AC500 V3 Multiple Vulnerabilities
\n
Direct Request ('Forced Browsing'), Incorrect Permission Assignment for Critical Resource, NULL Pointer Dereference
\n
\n\n
\n
\n
Background
\n
\n
Critical Infrastructure Sectors: Chemical, Critical Manufacturing, Energy, Water and Wastewater
The visualization allows users to create browser-based visualizations for monitoring and controlling industrial processes. Access to these visualizations can be restricted using the built-in user management. However, an unauthenticated remote attacker can bypass the user management and read visualization files by means of forced browsing. The exposed files, accessible via a web browser, contain only static visualization data such as text lists, icons or images, but no live data from the controlled system.
Vendor fix The problem is corrected in the following product versions: - AC500 V3 firmware version 3.9.0 ABB recommends that customers apply the update at earliest convenience. This firmware version is released for all AC500 V3 PLC types and available from Automation Builder 2.9.0. Automation Builder 2.9.0 is available for download from the related download site. https://www.abb.com/global/en/areas/motion/digital-tools/automation-builder/software-download
\n
Mitigation Refer to section \u201cGeneral security recommendations\u201d for further advise on how to keep your system secure.
A vulnerability in the runtime system allows low-privileged remote attackers to access the PKI folder via CODESYS protocol, enabling them to read and write certificates and keys. This exposes sensitive cryptographic data and allows unauthorized certificates to be trusted. However, all services remain available, only certificate based encryption and signing features are concerned. The issue affects systems using the optional CmpOpenSSL component for cryptographic operations.
Vendor fix The problem is corrected in the following product versions: - AC500 V3 firmware version 3.9.0 ABB recommends that customers apply the update at earliest convenience. This firmware version is released for all AC500 V3 PLC types and available from Automation Builder 2.9.0. Automation Builder 2.9.0 is available for download from the related download site. https://www.abb.com/global/en/areas/motion/digital-tools/automation-builder/software-download
\n
Mitigation Refer to section \u201cGeneral security recommendations\u201d for further advise on how to keep your system secure.
A vulnerability in the runtime system's CmpDevice component allows unauthenticated attackers to cause a denial-of-service (DoS) via specially crafted communication requests. The issue is triggered by a NULL pointer dereference and also affects systems when outdated clients attempt to log in.
Vendor fix The problem is corrected in the following product versions: - AC500 V3 firmware version 3.9.0 ABB recommends that customers apply the update at earliest convenience. This firmware version is released for all AC500 V3 PLC types and available from Automation Builder 2.9.0. Automation Builder 2.9.0 is available for download from the related download site. https://www.abb.com/global/en/areas/motion/digital-tools/automation-builder/software-download
\n
Mitigation Refer to section \u201cGeneral security recommendations\u201d for further advise on how to keep your system secure.
The information in this document is subject to change without notice, and should not be construed as a commitment by ABB. ABB provides no warranty, express or implied, including warranties of merchantability and fitness for a particular purpose, for the information contained in this document, and assumes no responsibility for any errors that may appear in this document. In no event shall ABB or any of its suppliers be liable for direct, indirect, special, incidental or consequential damages of any nature or kind arising from the use of this document, or from the use of any hardware or software described in this document, even if ABB or its suppliers have been advised of the possibility of such damages. This document and parts hereof must not be reproduced or copied without written permission from ABB, and the contents hereof must not be imparted to a third party nor used for any unauthorized purpose. All rights to registrations and trademarks reside with their respective owners.
\n\n
Frequently Asked Questions
\n
What causes the vulnerability? - Refer to section \u201cVulnerability severity and details\u201c. What is AC500 V3? - The AC500 V3 is a scalable range of Programmable Logic Controller (PLC). It provides solutions for small, medium and high-end applications. The AC500 V3 platform offers different performance levels and is the ideal choice for high availability, extreme environments, condition monitoring, motion control or safety solutions. It offers interoperability and compatibility in hardware and software from compact PLCs up to high end and safety PLCs. What might an attacker use the vulnerability to do? - An attacker who successfully exploited these vulnerabilities could bypass the user management and read visualization files (CVE-2025-2595), read and write certificates and keys (CVE-2025-41659) or cause a denial-of-service (DoS) (CVE-2025-41691). How could an attacker exploit the vulnerability? - Refer to section \u201cVulnerability severity and details\u201c. Could the vulnerability be exploited remotely? - Yes, an attacker who has network access to an affected system node could exploit the vulnerabilities. Recommended practices include that process control systems are physically protected, have no direct connections to the Internet, and are separated from other networks by means of a firewall system that has a minimal number of ports exposed. When this security advisory was issued, had this vulnerability been publicly disclosed? - Yes, the vulnerabilities have been publicly disclosed. When this security advisory was issued, had ABB received any reports that this vulnerability was being exploited? - No, ABB had not received any information indicating that this vulnerability had been exploited when this security advisory was originally issued.
\n\n
Legal Notice and Terms of Use
\n
This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
\n\n
Recommended Practices
\n
CISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability.
\n
Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.
\n
Locate control system networks and remote devices behind firewalls and isolate them from business networks.
\n
When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.
\n
CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
\n
CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
\n
CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
\n
Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
\n\n
Advisory Conversion Disclaimer
\n
This ICSA is a verbatim republication of ABB PSIRT 3ADR011524 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided \"as-is\" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact ABB PSIRT directly for any questions regarding this advisory.
\n
Revision History
\n
\n
Initial Release Date: 2026-02-24
\n
\n
\n\n
\n
Date
\n
Revision
\n
Summary
\n
\n\n\n
\n
2026-02-24
\n
1
\n
Initial version.
\n
\n
\n
2026-05-12
\n
2
\n
Initial CISA Republication of ABB PSIRT 3ADR011524 advisory
ABB became aware of severe vulnerability in the products versions listed as affected in the advisory. The Windows gateway is accessible remotely by default. Unauthenticated attackers can therefore search for PLCs, but the user management of the PLCs prevents the actual access to the PLCs \u2013 unless it is disabled
\n
The following versions of ABB Automation Builder Gateway for Windows are affected:
\n
\n
Automation Builder <2.9.0, 2.9.0
\n
\n
\n
\n\n
\n
CVSS
\n
Vendor
\n
Equipment
\n
Vulnerabilities
\n
\n\n\n
\n
v3 5.3
\n
ABB
\n
ABB Automation Builder Gateway for Windows
\n
Initialization of a Resource with an Insecure Default
\n
\n\n
\n
\n
Background
\n
\n
Critical Infrastructure Sectors: Chemical, Critical Manufacturing, Energy, Water and Wastewater
The gateway serves as a communication channel for various clients to AC500 PLCs. By default, the gateway listens on all available network adapters on port 1217 and can therefore be accessed remotely. How-ever, remote access to the gateway is only required in certain network configurations. Since the gateway is usually accessed locally, many users are unaware of this remote access option, which can enable scan-ning of and access to restricted PLC networks. Unauthenticated attackers can therefore search for PLCs, but the user management of the PLCs prevents the actual access to the PLCs \u2013 unless it is disabled. Please note that the gateway for Windows can be installed as a separate setup or as part of other setups such as the CODESYS Development System V3 setup or the CODESYS OPC DA Server setup.
Vendor fix If remote access is not required, check the \"LocalAddress\" setting in the [CmpGwCommDrvTcp] section of the Gateway's configuration file as follows (restart of gateway required in case of changes): [CmpGwCommDrvTcp] LocalAddress=127.0.0.1 ; allow access only from the local computer The gateway configuration file can be located at (example for Automation Builder 2.8): %ProgramFiles%\\ABB\\AB2.8\\AutomationBuilder\\GatewayPLC\\Gateway.cfg Starting with Automation Builder version 2.9.0 the vulnerability is closed by setting the default for the gateway to local access. Automation Builder 2.9.0 is available for download from the related download site. https://www.abb.com/global/en/areas/motion/digital-tools/automation-builder/software-download
\n
Workaround Workarounds are specific measures that a user can take to help block an attack, for example, temporarily disabling the vulnerable feature may remove the exposure with well-known impact on functionality. ABB has tested the following workarounds. Although these workarounds will not correct the underlying vulnerability, they can help block known attack vectors. When a workaround reduces functionality, this is identified below as \u201cImpact of workaround\u201d. The vulnerability can be closed by enabling local access only. See chapter \u201cRecommended immediate actions\u201d for details.
The information in this document is subject to change without notice, and should not be construed as a commitment by ABB. ABB provides no warranty, express or implied, including warranties of merchantability and fitness for a particular purpose, for the information contained in this document, and assumes no responsibility for any errors that may appear in this document. In no event shall ABB or any of its suppliers be liable for direct, indirect, special, incidental or consequential damages of any nature or kind arising from the use of this document, or from the use of any hardware or software described in this document, even if ABB or its suppliers have been advised of the possibility of such damages. This document and parts hereof must not be reproduced or copied without written permission from ABB, and the contents hereof must not be imparted to a third party nor used for any unauthorized purpose. All rights to registrations and trademarks reside with their respective owners.
\n\n
Frequently Asked Questions
\n
What causes the vulnerability? - Refer to section \u201cVulnerability severity and details\u201c. What is the ABB Automation Builder? - The ABB Automation Builder is the programming and commissioning tool mainly for the ABB PLC AC500 and the operator panels CP600. What might an attacker use the vulnerability to do? - An attacker who successfully exploited this vulnerability could scan for connected PLCs. Could the vulnerability be exploited remotely? - Yes, an attacker who has network access to an affected system node could exploit this vulnerability. Recommended practices include that process control systems are physically protected, have no direct connections to the Internet, and are separated from other networks by means of a firewall system that has a minimal number of ports exposed. What does the update do? - The update removes the vulnerability by setting the defaults of the gateway to local access. When this security advisory was issued, had this vulnerability been publicly disclosed? - Yes, this vulnerability has been publicly disclosed. When this security advisory was issued, had ABB received any reports that this vulnerability was being exploited? - No, ABB had not received any information indicating that this vulnerability had been exploited when this security advisory was originally issued.
\n\n
Legal Notice and Terms of Use
\n
This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
\n\n
Recommended Practices
\n
CISA recommends users take defensive measures to minimize the exploitation risk of these vulnerabilities.
\n
Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.
\n
Locate control system networks and remote devices behind firewalls and isolate them from business networks.
\n
When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.
\n
CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
\n
CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
\n
CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
\n
Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
\n\n
Advisory Conversion Disclaimer
\n
This ICSA is a verbatim republication of ABB PSIRT 3ADR011525 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided \"as-is\" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact ABB PSIRT directly for any questions regarding this advisory.
\n
Revision History
\n
\n
Initial Release Date: 2026-02-24
\n
\n
\n\n
\n
Date
\n
Revision
\n
Summary
\n
\n\n\n
\n
2026-02-24
\n
1
\n
Initial version.
\n
\n
\n
2026-05-12
\n
2
\n
Initial CISA Republication of ABB PSIRT 3ADR011525 advisory
Successful exploitation of this vulnerability could allow an attacker to elevate privileges from user to system, which may then enable the attacker to cause a temporary denial of service, open files, or delete files.
\n
The following versions of Fuji Electric Tellus are affected:
Kim Myung-gyu of Trend Micro Zero Day Initiative reported this vulnerability to CISA
\n
\n\n
Legal Notice and Terms of Use
\n
This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
\n\n
Recommended Practices
\n
CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
\n
CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
\n
CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.
\n
Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
\n
Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
\n
CISA also recommends users take the following measures to protect themselves from social engineering attacks:
\n
Do not click web links or open attachments in unsolicited email messages.
\n
Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.
\n
Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.
\n
No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time. This vulnerability is not exploitable remotely.
\n\n
Revision History
\n
\n
Initial Release Date: 2026-05-12
\n
\n
\n\n
\n
Date
\n
Revision
\n
Summary
\n
\n\n\n
\n
2026-05-12
\n
1
\n
Initial Publication
\n
\n\n
\n\n
Legal Notice and Terms of Use
",
"summary_is_html": true,
"first_seen": "Tue, 12 May 26 12:00:00 +0000",
"last_updated": "Tue, 12 May 26 12:00:00 +0000"
},
{
"id": "https://www.cisa.gov/news-events/alerts/2026/05/08/cisa-adds-one-known-exploited-vulnerability-catalog",
"title": "CISA Adds One Known Exploited Vulnerability to Catalog",
"source": "CISA Cybersecurity Advisory",
"source_url": "https://www.cisa.gov/news-events/alerts/2026/05/08/cisa-adds-one-known-exploited-vulnerability-catalog",
"summary": "
Although BOD 22-01 only applies to FCEB agencies, CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of KEV Catalog vulnerabilities as part of their vulnerability management practice. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.
",
"summary_is_html": true,
"first_seen": "Fri, 08 May 26 12:00:00 +0000",
"last_updated": "Fri, 08 May 26 12:00:00 +0000"
},
{
"id": "https://www.cisa.gov/news-events/alerts/2026/05/07/cisa-adds-one-known-exploited-vulnerability-catalog",
"title": "CISA Adds One Known Exploited Vulnerability to Catalog",
"source": "CISA Cybersecurity Advisory",
"source_url": "https://www.cisa.gov/news-events/alerts/2026/05/07/cisa-adds-one-known-exploited-vulnerability-catalog",
"summary": "
Although BOD 22-01 only applies to FCEB agencies, CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of KEV Catalog vulnerabilities as part of their vulnerability management practice. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.
Successful exploitation of this vulnerability may enable an attacker to access tenant email addresses and associated information in cleartext or cause a denial-of-service condition.
\n
The following versions of MAXHUB Pivot client application are affected:
\n
\n
MAXHUB Pivot client application
\n
\n
\n
\n\n
\n
CVSS
\n
Vendor
\n
Equipment
\n
Vulnerabilities
\n
\n\n\n
\n
v3 7.3
\n
MAXHUB
\n
MAXHUB Pivot client application
\n
Use of a Broken or Risky Cryptographic Algorithm
\n
\n\n
\n
\n
Background
\n
\n
Critical Infrastructure Sectors: Information Technology
This vulnerability, in the MAXHUB Pivot client application versions prior to v1.36.2, may allow an attacker to obtain encrypted tenant email addresses and related metadata from any tenant. Due to the presence of a hardcoded AES key within the application, the encrypted data can be decrypted, enabling access to tenant email addresses and associated information in cleartext. Furthermore, an attacker may be able to cause a denial-of-service condition by enrolling multiple unauthorized devices into a tenant via MQTT, potentially disrupting tenant operations.
Mitigation MAXHUB recommends users upgrade the Pivot client application to v1.36.2 or newer. The remediation has been made available through an OTA update. Users running v1.36.2 or later are not affected and need only ensure they continue to maintain the latest version. At this time, MAXHUB is not aware of any public exploitation of this issue. For more information, see the MAXHUB support page. https://www.maxhub.com/en/support/
Malik MAKKES and Yassine BENGANA of Abicom Groupe OCI reported this vulnerability to MAXHUB
\n
\n\n
Legal Notice and Terms of Use
\n
This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
\n\n
Recommended Practices
\n
CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the Internet. Locate control system networks and remote devices behind firewalls and isolating them from business networks. When remote access is required, use more secure methods, such as virtual private networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.
\n
CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
\n
CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
\n
CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.
\n
Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
\n
Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
\n
No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time.
\n\n
Revision History
\n
\n
Initial Release Date: 2026-05-07
\n
\n
\n\n
\n
Date
\n
Revision
\n
Summary
\n
\n\n\n
\n
2026-05-07
\n
1
\n
Initial Publication
\n
\n\n
\n\n
Legal Notice and Terms of Use
",
"summary_is_html": true,
"first_seen": "Thu, 07 May 26 12:00:00 +0000",
"last_updated": "Thu, 07 May 26 12:00:00 +0000"
},
{
"id": "https://www.cisa.gov/news-events/alerts/2026/05/06/cisa-adds-one-known-exploited-vulnerability-catalog",
"title": "CISA Adds One Known Exploited Vulnerability to Catalog",
"source": "CISA Cybersecurity Advisory",
"source_url": "https://www.cisa.gov/news-events/alerts/2026/05/06/cisa-adds-one-known-exploited-vulnerability-catalog",
"summary": "
Although BOD 22-01 only applies to FCEB agencies, CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of KEV Catalog vulnerabilities as part of their vulnerability management practice. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.
Hitachi Energy is aware of a vulnerability that affects the Hitachi Energy PCM600 product versions listed in this document. An attacker successfully exploiting this vulnerability can impact integrity of the product. Please refer to the Recommended Immediate Actions for information about the mitigation/remediation.
\n
The following versions of Hitachi Energy PCM600 are affected:
SharpZipLib before 1.0 RC1 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.
None available Prior to acquisition, PCM600 product versions 2.11 and earlier were distributed under ABB\u2019s organization. Some Hitachi Energy users may still be operating these legacy versions. While ABB continues to maintain the PCM600 2.x product line, Hitachi Energy now exclusively maintains and distributes the PCM600 3.x product line. ABB has recently published a cybersecurity advisory [2NGA002813] (https://library.e.abb.com/public/ec33308ad2c34f92bab09df09c66954d/2NGA002813_PCM600_Sharpziplib_Vulnerability.pdf) with their recommended actions for this same vulnerability. However, because Hitachi Energy does not maintain or validate the PCM600 2.x releases, they cannot assess or guarantee the compatibility of ABB\u2019s recommended updates with other Hitachi Energy IEDs (Relion 670 series, 650 series, SAM600, PWC600). PCM600 versions 3.0, and later are the Hitachi Energy maintained and validated versions, Hitachi Energy strongly recommends users to migrate to these versions. Additionally, please follow Hitachi Energy's [Industrial Control Systems Best Practices,](https://publisher.hitachienergy.com/preview?DocumentID=8DBD000235&LanguageCode=en&DocumentPartId=&Action=Launch) until the planned remediation is released. Contact your support representative for more detailed guidance tailored to your deployment.
\n
Mitigation Ensure that Chapter 4 of Cyber Security Deployment Guideline - 1MRK505410 has been followed during the deployment. Ensure that no default credentials are in use. In case of exceptions, please ensure they have been mitigated with adequate countermeasures.
\n
Vendor fix Update to PCM600 3.1 SP4 (Update Planned)
Hitachi Energy reported this vulnerability to CISA.
\n
\n\n
Notice
\n
The information in this document is subject to change without notice and should not be construed as a commitment by Hitachi Energy. Hitachi Energy provides no warranty, express or implied, including warranties of merchantability and fitness for a particular purpose, for the information contained in this document, and assumes no responsibility for any errors that may appear in this document. In no event shall Hitachi Energy or any of its suppliers be liable for direct, indirect, special, incidental or consequential damages of any nature or kind arising from the use of this document, or from the use of any hardware or software described in this document, even if Hitachi Energy or its suppliers have been advised of the possibility of such damages. This document and parts hereof must not be reproduced or copied without written permission from Hitachi Energy and the contents hereof must not be imparted to a third party nor used for any unauthorized purpose. All rights to registrations and trademarks reside with their respective owners.
\n\n
Support
\n
For additional information and support please contact your product provider or Hitachi Energy service organization. For contact information, see https://www.hitachienergy.com/contact-us/ for Hitachi Energy contact-centers.
\n\n
General Mitigation Factors
\n
It is highly recommended to deploy the product following the \u201cPCM600 3.1 Cyber Security Deployment Guideline\u201d document. Customers should maintain their systems with products running on supported versions and follow maintenance releases. Recommended security practices and firewall configurations can help protect a process control network from attacks that originate from outside the network. Such practices include that process control systems are physically protected from direct access by unauthorized personnel, have no direct connections to the Internet, and are separated from other networks by means of a firewall system that has a minimal number of ports exposed, and others that have to be evaluated case by case. Process control systems should not be used for Internet surfing, instant messaging, or receiving e-mails. Portable computers and removable storage media should be carefully scanned for viruses before they are connected to a control system.
\n\n
SSVC
\n
SSVCv2/E:N/A:N/2026-04-24T14:16:01Z/
\n\n
Legal Notice and Terms of Use
\n
This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
\n\n
Recommended Practices
\n
CISA recommends users take defensive measures to minimize the exploitation risk of these vulnerabilities. Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet. Locate control system networks and remote devices behind firewalls and isolate them from business networks. When remote access is required, use more secure methods, such as virtual private networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.
\n
CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
\n
CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
\n
CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
\n
Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
\n\n
Advisory Conversion Disclaimer
\n
This ICSA is a verbatim republication of Hitachi Energy 8DBD000239 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided \"as-is\" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact Hitachi Energy directly for any questions regarding this advisory.
\n
Revision History
\n
\n
Initial Release Date: 2026-04-28
\n
\n
\n\n
\n
Date
\n
Revision
\n
Summary
\n
\n\n\n
\n
2026-04-28
\n
1
\n
Initial public release
\n
\n
\n
2026-05-05
\n
2
\n
Initial CISA Republication of Hitachi Energy 8DBD000239 advisory
Tom Hulme of CSACyber reported this vulnerability to Johnson Controls
\n
\n\n
Legal Notice and Terms of Use
\n
This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
\n\n
Recommended Practices
\n
CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability.
\n
Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.
\n
Locate control system networks and remote devices behind firewalls and isolating them from business networks.
\n
When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.
\n
CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
\n
CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
\n
CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.
\n
Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
\n
Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
\n
CISA also recommends users take the following measures to protect themselves from social engineering attacks:
\n
Do not click web links or open attachments in unsolicited email messages.
\n
Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.
\n
Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.
\n
No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time. This vulnerability is not exploitable remotely.
\n\n
Revision History
\n
\n
Initial Release Date: 2026-05-05
\n
\n
\n\n
\n
Date
\n
Revision
\n
Summary
\n
\n\n\n
\n
2026-05-05
\n
1
\n
Initial Republication of Johnson Controls product security advisory.
ABB became aware of vulnerability in the product versions listed as affected in the advisory. An update is now available that addresses and remediates the vulnerability. An attacker who successfully exploited this vulnerability could read sensitive information in the logging data of the PVI client application. Logging is deactivated by default in all PVI client versions.
\n
The following versions of ABB B&R PVI are affected:
An Insertion of Sensitive Information into Log File vulnerability in B&R PVI client versions prior to 6.5 may be abused by an authenticated local attacker to gather credential information which is processed by the PVI client application. The logging function of the PVI client application is disabled by default and must be explicitly enabled by the user.
Vendor fix The problem is corrected in the following product versions: - PVI 6.5.0 Please note that PVI is included in the Automation Studio installation package and shares the same version number as the corresponding Automation Studio release. B&R recommends that customers apply the update at earliest convenience. The process to install updates is described in the user manual. The step to identify the installed product version is described in the user manual.
\n
Mitigation This vulnerability is limited to the PVI client side application logging and does not impact any security related logging of the PVI server component. Logging is not enabled by default for PVI client applications. Activate logging on the client system only when it is required for troubleshooting, debugging or analysis. Ensure that all client side logging information is securely deleted after it is no longer needed. When enabling logging in PVI client applications, the storage path for the log files must be specified. Make sure that only the respective user has access to the directories where the logging information is stored. Refer to section \u201cGeneral security recommendations\u201d for further advise on how to keep your system secure.
The information in this document is subject to change without notice, and should not be construed as a commitment by B&R. B&R provides no warranty, express or implied, including warranties of merchantability and fitness for a particular purpose, for the information contained in this document, and assumes no responsibility for any errors that may appear in this document. In no event shall B&R or any of its suppliers be liable for direct, indirect, special, incidental or consequential damages of any nature or kind arising from the use of this document, or from the use of any hardware or software described in this document, even if B&R or its suppliers have been advised of the possibility of such damages. This document and parts hereof must not be reproduced or copied without written permission from B&R, and the contents hereof must not be imparted to a third party nor used for any unauthorized purpose. All rights to registrations and trademarks reside with their respective owners.
\n\n
Legal Notice and Terms of Use
\n
This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
\n\n
Recommended Practices
\n
CISA recommends users take defensive measures to minimize the exploitation risk of these vulnerabilities.
\n
Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.
\n
Locate control system networks and remote devices behind firewalls and isolate them from business networks.
\n
When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.
\n
CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
\n
CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
\n
CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
\n
Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
\n\n
Advisory Conversion Disclaimer
\n
This ICSA is a verbatim republication of ABB PSIRT SA26P001 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided \"as-is\" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact ABB PSIRT directly for any questions regarding this advisory.
\n
Revision History
\n
\n
Initial Release Date: 2026-01-29
\n
\n
\n\n
\n
Date
\n
Revision
\n
Summary
\n
\n\n\n
\n
2026-01-29
\n
1
\n
Initial version.
\n
\n
\n
2026-05-05
\n
2
\n
Initial CISA Republication of ABB PSIRT SA26P001 advisory
ABB became aware of vulnerability in the product versions listed as affected in the advisory. An update is available that resolves a vulnerability. An attacker who successfully exploited this vulnerability could cause the product to stop.
\n
The following versions of ABB B&R Automation Runtime are affected:
An Allocation of Resources Without Limits or Throttling vulnerability in the ANSL-Server component of B&R Automation Runtime versions prior to 6.5 and prior to R4.93 could be exploited by an unauthenticated attacker on the net-work to win a race condition, resulting in permanent denial-of-service (DoS) conditions on affected devices.
Vendor fix The problem is corrected in the following product versions: - Automation Runtime 6 versions >= 6.5 - Automation Runtime 4 versions >= R4.93 B&R recommends that customers apply the update at earliest convenience. The process to install updates is described in the user manual. The step to identify the installed product version is described in the user manual.
\n
Mitigation The vulnerability cannot be exploited on all devices or across all customer applications. Extensive investigations by B&R have determined that shorter cycle times in customer projects increase the likelihood of potential exploitation. For customers unable to transition to a patched version, adjusting their application configuration to longer cycle times may therefore be considered as a mitigating measure. B&R Automation Runtime is designed to be operated on Level 1 of the ABB ICS Cyber Security Reference Architecture. Exploitation of the vulnerability from outside Level 1 would require an attacker to bypass the Control Network Firewall. Limiting the maximum data traffic and the maximum number of concurrent connections to the ANSL server of Automation Runtime on the Control Network Firewall, shall be considered to mitigate this vulnerability. B&R further recommends, in alignment with its Defense in Depth for B&R Products guidelines, that customers: - Test the maximum load capacity of their application under Automation Runtime before commissioning. - Restrict the permitted data traffic to the device via the Control Network Firewall to no more than 80% of the measured peak traffic value. Refer to section \u201cGeneral security recommendations\u201d for further advise on how to keep your system secure.
The information in this document is subject to change without notice, and should not be construed as a commitment by B&R. B&R provides no warranty, express or implied, including warranties of merchantability and fitness for a particular purpose, for the information contained in this document, and assumes no responsibility for any errors that may appear in this document. In no event shall B&R or any of its suppliers be liable for direct, indirect, special, incidental or conse-quential damages of any nature or kind arising from the use of this document, or from the use of any hardware or software described in this document, even if B&R or its suppliers have been advised of the possibility of such damages. This document and parts hereof must not be reproduced or copied without written permission from B&R, and the contents hereof must not be imparted to a third party nor used for any unauthorized purpose. All rights to registrations and trademarks reside with their respective owners.
\n\n
Frequently Asked Questions
\n
What causes the vulnerability? - The vulnerability is caused by insufficient throttling and limiting mechanism in the ANSL Server used the B&R Automation Runtime. What might an attacker use the vulnerability to do? - An attacker who successfully exploited this vulnerability could cause the affected system node to stop. How could an attacker exploit the vulnerability? - An attacker could try to exploit the vulnerability by creating a specially crafted message and sending the message to an affected system node. This would require that the attacker has access to the system network, by connecting to the net-work either directly or through a wrongly configured or penetrated firewall, or that he installs malicious software on a system node or otherwise infects the network with malicious software. Recommended practices help mitigate such attacks, see section Mitigating Factors above. Could the vulnerability be exploited remotely? - Yes, an attacker who has network access to an affected system node could exploit this vulnerability. Recommended practices include that process control systems are physically protected, have no direct connections to the Internet, and are separated from other networks by means of a firewall system that has a minimal number of ports exposed. What does the update do? - The update removes the vulnerability by limiting incoming network traffic that is handled by the ANSL server component. When this security advisory was issued, had this vulnerability been publicly disclosed? - No, B&R discovered this vulnerability as a part of its own security analysis. When this security advisory was issued, had B&R received any reports that this vulnerability was being exploited? - No, B&R had not received any information indicating that this vulnerability had been exploited when this security advisory was originally issued.
\n\n
Legal Notice and Terms of Use
\n
This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
\n\n
Recommended Practices
\n
CISA recommends users take defensive measures to minimize the exploitation risk of these vulnerabilities.
\n
Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.
\n
Locate control system networks and remote devices behind firewalls and isolate them from business networks.
\n
When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.
\n
CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
\n
CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
\n
CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
\n
Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
\n\n
Advisory Conversion Disclaimer
\n
This ICSA is a verbatim republication of ABB PSIRT SA25P005 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided \"as-is\" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact ABB PSIRT directly for any questions regarding this advisory.
\n
Revision History
\n
\n
Initial Release Date: 2026-01-19
\n
\n
\n\n
\n
Date
\n
Revision
\n
Summary
\n
\n\n\n
\n
2026-01-19
\n
1
\n
Initial version.
\n
\n
\n
2026-05-05
\n
2
\n
Initial CISA Republication of ABB PSIRT SA25P005 advisory
ABB became aware of vulnerability in the product versions listed as affected in the advisory. An update is available that resolves a vulnerability. Successful exploitation of this vulnerability may enable an attacker to masquerade as a trusted party when B&R Automation Studio establishes a connection with a server via the ANSL over TLS or OPC-UA protocol.
\n
The following versions of ABB B&R Automation Studio are affected:
An Improper Certificate Validation vulnerability in the OPC-UA client and ANSL over TLS client used in Automation Studio versions before 6.5 could allow an unauthenticated attacker on the network to position themselves to intercept and interfere with data exchanges.
Vendor fix The problem is corrected in the following product versions: B&R Automation Studio version 6.5 B&R recommends that customers apply the update at earliest convenience. The process to install updates is described in the user manual. The step to identify the installed product version is de-scribed in the user manual.
\n
Mitigation To exploit this vulnerability, an attacker would need to intercept and redirect the communication between B&R Automation Studio and the target server, as well as present manipulated certificates that pass validation checks. B&R recommends operating B&R Automation Studio within Level 2 of the ABB ICS Cyber Security Reference Architecture when connecting to Level 1 devices via ANSL over TLS or OPC-UA. Operating in this trusted environment reduces the risk of successful exploitation drastically. Refer to section \u201cGeneral security recommendations\u201d for further advise on how to keep your system secure.
The information in this document is subject to change without notice, and should not be construed as a commitment by B&R. B&R provides no warranty, express or implied, including warranties of merchantability and fitness for a particular purpose, for the information contained in this document, and assumes no responsibility for any errors that may appear in this document. In no event shall B&R or any of its suppliers be liable for direct, indirect, special, incidental or conse-quential damages of any nature or kind arising from the use of this document, or from the use of any hardware or software described in this document, even if B&R or its suppliers have been advised of the possibility of such damages. This document and parts hereof must not be reproduced or copied without written permission from B&R, and the contents hereof must not be imparted to a third party nor used for any unauthorized purpose. All rights to registrations and trademarks reside with their respective owners.
\n\n
Frequently Asked Questions
\n
What causes the vulnerability? - The vulnerability is caused by insufficient validation mechanisms for server certificates in the ANSL over TLS and OPC-UA client implementations. What is B&R Automation Studio? - B&R Automation Studio is an environment for developing and executing automation solutions, ranging from control and motion technology to HMI, operation, and integrated safety technology. What might an attacker use the vulnerability to do? - An attacker who successfully exploited this vulnerability could spoof a trusted server, potentially leading to the disclosure of confidential information or the alteration of data during transit. How could an attacker exploit the vulnerability? - An attacker could attempt to exploit this vulnerability by generating a maliciously crafted server certificate and manipulating network routing or name resolution to redirect traffic through a compromised node under their control. This would require that the attacker has access to the system network, by connecting to the network either directly or through a wrongly configured or penetrated firewall, or that he installs malicious software on a system node or other-wise infects the network with malicious software. Recommended practices help mitigate such attacks, see section Miti-gating Factors above. Could the vulnerability be exploited remotely? - Yes, an attacker who has network access to an affected system node could exploit this vulnerability. Recommended practices include that process control systems are physically protected, have no direct connections to the Internet, and are separated from other networks by means of a firewall system that has a minimal number of ports exposed. What does the update do? - The update removes the vulnerability by modifying the way that the ANSL and OPC-UA clients are validating server certificates. When this security advisory was issued, had this vulnerability been publicly disclosed? - No, B&R discovered this vulnerability as a part of its own security analysis. When this security advisory was issued, had B&R received any reports that this vulnerability was being exploited? - No, B&R had not received any information indicating that this vulnerability had been exploited when this security advisory was originally issued
\n\n
Legal Notice and Terms of Use
\n
This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
\n\n
Recommended Practices
\n
CISA recommends users take defensive measures to minimize the exploitation risk of these vulnerabilities.
\n
Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.
\n
Locate control system networks and remote devices behind firewalls and isolate them from business networks.
\n
When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.
\n
CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
\n
CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
\n
CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
\n
Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
\n\n
Advisory Conversion Disclaimer
\n
This ICSA is a verbatim republication of ABB PSIRT SA25P004 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided \"as-is\" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact ABB PSIRT directly for any questions regarding this advisory.
\n
Revision History
\n
\n
Initial Release Date: 2026-01-19
\n
\n
\n\n
\n
Date
\n
Revision
\n
Summary
\n
\n\n\n
\n
2026-01-19
\n
1
\n
Initial Version
\n
\n
\n
2026-05-05
\n
2
\n
Initial CISA Republication of ABB PSIRT SA25P004 advisory
\n
\n\n
\n\n
Legal Notice and Terms of Use
",
"summary_is_html": true,
"first_seen": "Tue, 05 May 26 12:00:00 +0000",
"last_updated": "Tue, 05 May 26 12:00:00 +0000"
},
{
"id": "https://www.cisa.gov/news-events/alerts/2026/05/01/cisa-adds-one-known-exploited-vulnerability-catalog",
"title": "CISA Adds One Known Exploited Vulnerability to Catalog",
"source": "CISA Cybersecurity Advisory",
"source_url": "https://www.cisa.gov/news-events/alerts/2026/05/01/cisa-adds-one-known-exploited-vulnerability-catalog",
"summary": "
Although BOD 22-01 only applies to FCEB agencies, CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of KEV Catalog vulnerabilities as part of their vulnerability management practice. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.
",
"summary_is_html": true,
"first_seen": "Fri, 01 May 26 12:00:00 +0000",
"last_updated": "Fri, 01 May 26 12:00:00 +0000"
},
{
"id": "https://www.cisa.gov/resources-tools/resources/careful-adoption-agentic-ai-services",
"title": "Careful Adoption of Agentic AI Services",
"source": "CISA Cybersecurity Advisory",
"source_url": "https://www.cisa.gov/resources-tools/resources/careful-adoption-agentic-ai-services",
"summary": "
CISA, in collaboration with the Australian Signals Directorate\u2019s Australian Cyber Security Centre (ASD\u2019s ACSC) and other international and U.S. partners, released guidance for organizations on adopting agentic artificial intelligence (AI) systems.
\n
This guide outlines key security challenges and risks associated with agentic AI, and provides actionable steps for designing, deploying, and operating these systems safely. It helps organizations align AI risk management with existing cybersecurity frameworks and strengthen oversight as agentic AI adoption grows.
Successful exploitation of this vulnerability could allow an attacker to bypass user authentication on OPTIMAX installations that make use of the Azure Active Directory Single-Sign On integration.
\n
The following versions of ABB Ability OPTIMAX are affected:
\n
\n
ABB Ability OPTIMAX 6.1 vers:all/*
\n
ABB Ability OPTIMAX 6.2 vers:all/*
\n
ABB Ability OPTIMAX 6.3 <6.3.1-251120
\n
ABB Ability OPTIMAX 6.4 <6.4.1-251120
\n
\n
\n
\n\n
\n
CVSS
\n
Vendor
\n
Equipment
\n
Vulnerabilities
\n
\n\n\n
\n
v3 8.1
\n
ABB
\n
ABB Ability OPTIMAX
\n
Incorrect Implementation of Authentication Algorithm
\n
\n\n
\n
\n
Background
\n
\n
Critical Infrastructure Sectors: Energy, Water and Wastewater
The vulnerability allows an attacker to bypass user authentication on OPTIMAX installations that make use of the Azure Active Directory Single-Sign On integration.
Mitigation The following product versions have been fixed:
\n
Ability OPTIMAX 6.3 6.3.1-251120 is a fixed version for CVE-2025-14510
\n
Mitigation For more information see the associated ABB PSIRT security advisory 9AKK108472A1331 ABB CYBERSECURITY ADVISORY - PDF Version (https://search.abb.com/library/Download.aspx?DocumentID=9AKK108472A1331&LanguageCode=en&DocumentPartId=&Action=Launch), ABB CYBERSECURITY ADVISORY - CSAF Version (https://psirt.abb.com/csaf/2026/9akk108472a1331.json). https://search.abb.com/library/Download.aspx?DocumentID=9AKK108472A1331&LanguageCode=en&DocumentPartId=&Action=Launch
\n
Mitigation For more information see the associated ABB PSIRT security advisory 9AKK108472A1331 ABB CYBERSECURITY ADVISORY - PDF Version (https://search.abb.com/library/Download.aspx?DocumentID=9AKK108472A1331&LanguageCode=en&DocumentPartId=&Action=Launch), ABB CYBERSECURITY ADVISORY - CSAF Version (https://psirt.abb.com/csaf/2026/9akk108472a1331.json). https://psirt.abb.com/csaf/2026/9akk108472a1331.json
This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
\n\n
Recommended Practices
\n
CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability.
\n
Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.
\n
Locate control system networks and remote devices behind firewalls and isolating them from business networks.
\n
When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs). Recognize VPNs may have vulnerabilities, should be updated to the most recent version available, and are only as secure as the connected devices.
\n
CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
\n
CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
\n
CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.
\n
Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
\n
Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
\n
CISA also recommends users take the following measures to protect themselves from social engineering attacks:
\n
Do not click web links or open attachments in unsolicited email messages.
\n
Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.
\n
Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.
\n
No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time. This vulnerability has a high attack complexity.
\n\n
Revision History
\n
\n
Initial Release Date: 2026-04-30
\n
\n
\n\n
\n
Date
\n
Revision
\n
Summary
\n
\n\n\n
\n
2026-04-30
\n
1
\n
Initial Republication of ABB PSIRT 9AKK108472A1331
Successful exploitation of these vulnerabilities could allow an attacker to remotely reboot the device or complete an unauthenticated query to reveal system configuration, including sensitive details.
\n
The following versions of ABB AWIN Gateways are affected:
Mitigation The following product versions have been fixed: ABB AWIN Firmware 2.1-0 installed on ABB AWIN GW100 rev. 2 (Product ID: 3BNP102988R1) are fixed versions for CVE-2025-13777 ABB AWIN Firmware2.0-0 installed on ABB AWIN GW120 (Product ID 3BNP103003R1) are fixed versions for CVE-2025-13777
\n
Mitigation For more information see the associated ABB PSIRT security advisory 4JNO000329 ABB CYBERSECURITY ADVISORY - PDF Version https://search.abb.com/library/Download.aspx?DocumentID=4JNO000329&LanguageCode=en&DocumentPartId=&Action=Launch, ABB CYBERSECURITY ADVISORY - CSAF Version https://psirt.abb.com/csaf/2026/4jno000329.json. https://search.abb.com/library/Download.aspx?DocumentID=4JNO000329&LanguageCode=en&DocumentPartId=&Action=Launch
\n
Mitigation For more information see the associated ABB PSIRT security advisory 4JNO000329 ABB CYBERSECURITY ADVISORY - PDF Version https://search.abb.com/library/Download.aspx?DocumentID=4JNO000329&LanguageCode=en&DocumentPartId=&Action=Launch, ABB CYBERSECURITY ADVISORY - CSAF Version https://psirt.abb.com/csaf/2026/4jno000329.json. https://psirt.abb.com/csaf/2026/4jno000329.json
Mitigation The following product versions have been fixed: ABB AWIN Firmware 2.1-0 installed on ABB AWIN GW100 rev. 2 (Product ID: 3BNP102988R1) are fixed versions for CVE-2025-13778 ABB AWIN Firmware2.0-0 installed on ABB AWIN GW120 (Product ID 3BNP103003R1) are fixed versions for CVE-2025-13778
\n
Mitigation For more information see the associated ABB PSIRT security advisory 4JNO000329 ABB CYBERSECURITY ADVISORY - PDF Version https://search.abb.com/library/Download.aspx?DocumentID=4JNO000329&LanguageCode=en&DocumentPartId=&Action=Launch, ABB CYBERSECURITY ADVISORY - CSAF Version https://psirt.abb.com/csaf/2026/4jno000329.json. https://search.abb.com/library/Download.aspx?DocumentID=4JNO000329&LanguageCode=en&DocumentPartId=&Action=Launch
\n
Mitigation For more information see the associated ABB PSIRT security advisory 4JNO000329 ABB CYBERSECURITY ADVISORY - PDF Version https://search.abb.com/library/Download.aspx?DocumentID=4JNO000329&LanguageCode=en&DocumentPartId=&Action=Launch, ABB CYBERSECURITY ADVISORY - CSAF Version https://psirt.abb.com/csaf/2026/4jno000329.json. https://psirt.abb.com/csaf/2026/4jno000329.json
Mitigation The following product versions have been fixed: ABB AWIN Firmware 2.1-0 installed on ABB AWIN GW100 rev. 2 (Product ID: 3BNP102988R1) are fixed versions for CVE-2025-13779 ABB AWIN Firmware2.0-0 installed on ABB AWIN GW120 (Product ID 3BNP103003R1) are fixed versions for CVE-2025-13779
\n
Mitigation For more information see the associated ABB PSIRT security advisory 4JNO000329 ABB CYBERSECURITY ADVISORY - PDF Version https://search.abb.com/library/Download.aspx?DocumentID=4JNO000329&LanguageCode=en&DocumentPartId=&Action=Launch, ABB CYBERSECURITY ADVISORY - CSAF Version https://psirt.abb.com/csaf/2026/4jno000329.json. https://search.abb.com/library/Download.aspx?DocumentID=4JNO000329&LanguageCode=en&DocumentPartId=&Action=Launch
\n
Mitigation For more information see the associated ABB PSIRT security advisory 4JNO000329 ABB CYBERSECURITY ADVISORY - PDF Version https://search.abb.com/library/Download.aspx?DocumentID=4JNO000329&LanguageCode=en&DocumentPartId=&Action=Launch, ABB CYBERSECURITY ADVISORY - CSAF Version https://psirt.abb.com/csaf/2026/4jno000329.json. https://psirt.abb.com/csaf/2026/4jno000329.json
Fred Alvarez reported these vulnerabilities to ABB
\n
\n\n
Legal Notice and Terms of Use
\n
This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
\n\n
Recommended Practices
\n
CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities.
\n
Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.
\n
Locate control system networks and remote devices behind firewalls and isolating them from business networks.
\n
When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs). Recognize VPNs may have vulnerabilities, should be updated to the most recent version available, and are only as secure as the connected devices.
\n
CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
\n
CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
\n
CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.
\n
Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
\n
Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
\n
CISA also recommends users take the following measures to protect themselves from social engineering attacks:
\n
Do not click web links or open attachments in unsolicited email messages.
\n
Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.
\n
Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.
\n
No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time. These vulnerabilities are not exploitable remotely.
ABB became aware of vulnerability in the products versions listed as affected in the advisory. The ABB S+ Engineering product versions are affected by vulnerabilities in PostgreSQL version 13.11 and earlier versions. If an attacker gains access to a site\u2019s S+ Client Server network, they could exploit such vulnerabilities by executing arbitrary code and potentially compromising the entire system.
\n
The following versions of ABB Ability Symphony Plus Engineering are affected:
Integer Overflow or Wraparound, Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), Time-of-check Time-of-use (TOCTOU) Race Condition, Privilege Dropping / Lowering Errors
\n
\n\n
\n
\n
Background
\n
\n
Critical Infrastructure Sectors: Chemical, Critical Manufacturing, Energy, Water and Wastewater
An attacker running as an authenticated PostgreSQL user can provide crafted data and trigger the integer overflow due to such missing overflow check. This can enable the execution of arbitrary code in the system.
Product Version: ABB Ability Symphony Plus S+ Engineering 2.2, ABB Ability Symphony Plus S+ Engineering 2.3, ABB Ability Symphony Plus S+ Engineering 2.3 RU1, ABB Ability Symphony Plus S+ Engineering 2.3 RU2, ABB Ability Symphony Plus S+ Engineering 2.3 RU3, ABB Ability Symphony Plus S+ Engineering 2.4, ABB Ability Symphony Plus S+ Engineering 2.4 SP1, ABB Ability Symphony Plus S+ Engineering 2.4 SP2
\n
Product Status: fixed, known_affected
\n
\n
\n
Remediations
\n
Vendor fix ABB advises all customers to review their installations to determine if they are using an impacted product as listed above, no further analysis or tools are needed to make this determination. The recommended immediate actions per product are listed below: - Systems using S+ Engineering 2.2 through 2.4 SP2 should upgrade to S+ Engineering 2.4 SP2 RU1 (re-leased in December 2024) or later. - End users who are unable to install one of these updates should immediately look to implement the Mitigation and Workarounds listed below as this will restrict or prevent an attacker\u2019s ability to com-promise the system. ABB recommends that customers apply the update at the earliest convenience.
\n
Mitigation Any exploit of these vulnerabilities would require that the attacker has access to the site\u2019s S+ client/server network. Following ABB\u2019s recommended security practices, including network architecture and perimeter firewall, are mitigating factors in preventing external access to the S+ client/server net-work. Refer to section \u201cGeneral security recommendations\u201d for further advise on how to keep your system secure.
\n
Workaround No workarounds are available. Assess the installation specific risk based on this advisory. Use the recommendations described under \u201cMitigating factors\u201d or \u201cRecommended immediate actions\u201d.
If an administrator has installed Extension scripts and specific data is used inside a quoting con-struct, an attacker having proper PostgreSQL privileges can execute arbitrary code in the system as the administrator.
Product Version: ABB Ability Symphony Plus S+ Engineering 2.2, ABB Ability Symphony Plus S+ Engineering 2.3, ABB Ability Symphony Plus S+ Engineering 2.3 RU1, ABB Ability Symphony Plus S+ Engineering 2.3 RU2, ABB Ability Symphony Plus S+ Engineering 2.3 RU3, ABB Ability Symphony Plus S+ Engineering 2.4, ABB Ability Symphony Plus S+ Engineering 2.4 SP1, ABB Ability Symphony Plus S+ Engineering 2.4 SP2
\n
Product Status: fixed, known_affected
\n
\n
\n
Remediations
\n
Vendor fix ABB advises all customers to review their installations to determine if they are using an impacted product as listed above, no further analysis or tools are needed to make this determination. The recommended immediate actions per product are listed below: - Systems using S+ Engineering 2.2 through 2.4 SP2 should upgrade to S+ Engineering 2.4 SP2 RU1 (re-leased in December 2024) or later. - End users who are unable to install one of these updates should immediately look to implement the Mitigation and Workarounds listed below as this will restrict or prevent an attacker\u2019s ability to com-promise the system. ABB recommends that customers apply the update at the earliest convenience.
\n
Mitigation Any exploit of these vulnerabilities would require that the attacker has access to the site\u2019s S+ client/server network. Following ABB\u2019s recommended security practices, including network architecture and perimeter firewall, are mitigating factors in preventing external access to the S+ client/server net-work. Refer to section \u201cGeneral security recommendations\u201d for further advise on how to keep your system secure.
\n
Workaround No workarounds are available. Assess the installation specific risk based on this advisory. Use the recommendations described under \u201cMitigating factors\u201d or \u201cRecommended immediate actions\u201d.
A \u2018time-of-check time-of-use\u2019 (TOCTOU) race condition in a PostgreSQL can allow an attacker to easily execute arbitrary SQL functions by leveraging a PostgreSQL utility often executed with high privileges.
Product Version: ABB Ability Symphony Plus S+ Engineering 2.2, ABB Ability Symphony Plus S+ Engineering 2.3, ABB Ability Symphony Plus S+ Engineering 2.3 RU1, ABB Ability Symphony Plus S+ Engineering 2.3 RU2, ABB Ability Symphony Plus S+ Engineering 2.3 RU3, ABB Ability Symphony Plus S+ Engineering 2.4, ABB Ability Symphony Plus S+ Engineering 2.4 SP1, ABB Ability Symphony Plus S+ Engineering 2.4 SP2
\n
Product Status: fixed, known_affected
\n
\n
\n
Remediations
\n
Vendor fix ABB advises all customers to review their installations to determine if they are using an impacted product as listed above, no further analysis or tools are needed to make this determination. The recommended immediate actions per product are listed below: - Systems using S+ Engineering 2.2 through 2.4 SP2 should upgrade to S+ Engineering 2.4 SP2 RU1 (re-leased in December 2024) or later. - End users who are unable to install one of these updates should immediately look to implement the Mitigation and Workarounds listed below as this will restrict or prevent an attacker\u2019s ability to com-promise the system. ABB recommends that customers apply the update at the earliest convenience.
\n
Mitigation Any exploit of these vulnerabilities would require that the attacker has access to the site\u2019s S+ client/server network. Following ABB\u2019s recommended security practices, including network architecture and perimeter firewall, are mitigating factors in preventing external access to the S+ client/server net-work. Refer to section \u201cGeneral security recommendations\u201d for further advise on how to keep your system secure.
\n
Workaround No workarounds are available. Assess the installation specific risk based on this advisory. Use the recommendations described under \u201cMitigating factors\u201d or \u201cRecommended immediate actions\u201d.
An attacker can provide untrusted materialized views and lure a high privileged authorized user to inadvertently execute arbitrary SQL functions by refreshing the attacker's materialized view.
Product Version: ABB Ability Symphony Plus S+ Engineering 2.2, ABB Ability Symphony Plus S+ Engineering 2.3, ABB Ability Symphony Plus S+ Engineering 2.3 RU1, ABB Ability Symphony Plus S+ Engineering 2.3 RU2, ABB Ability Symphony Plus S+ Engineering 2.3 RU3, ABB Ability Symphony Plus S+ Engineering 2.4, ABB Ability Symphony Plus S+ Engineering 2.4 SP1, ABB Ability Symphony Plus S+ Engineering 2.4 SP2
\n
Product Status: fixed, known_affected
\n
\n
\n
Remediations
\n
Vendor fix ABB advises all customers to review their installations to determine if they are using an impacted product as listed above, no further analysis or tools are needed to make this determination. The recommended immediate actions per product are listed below: - Systems using S+ Engineering 2.2 through 2.4 SP2 should upgrade to S+ Engineering 2.4 SP2 RU1 (re-leased in December 2024) or later. - End users who are unable to install one of these updates should immediately look to implement the Mitigation and Workarounds listed below as this will restrict or prevent an attacker\u2019s ability to com-promise the system. ABB recommends that customers apply the update at the earliest convenience.
\n
Mitigation Any exploit of these vulnerabilities would require that the attacker has access to the site\u2019s S+ client/server network. Following ABB\u2019s recommended security practices, including network architecture and perimeter firewall, are mitigating factors in preventing external access to the S+ client/server net-work. Refer to section \u201cGeneral security recommendations\u201d for further advise on how to keep your system secure.
\n
Workaround No workarounds are available. Assess the installation specific risk based on this advisory. Use the recommendations described under \u201cMitigating factors\u201d or \u201cRecommended immediate actions\u201d.
ABB Global reported these vulnerabilities to CISA.
\n
\n\n
Notice
\n
The information in this document is subject to change without notice, and should not be construed as a commitment by ABB. ABB provides no warranty, express or implied, including warranties of merchantability and fitness for a particular purpose, for the information contained in this document, and assumes no responsibility for any errors that may appear in this document. In no event shall ABB or any of its suppliers be liable for direct, indirect, special, incidental or consequential damages of any nature or kind arising from the use of this document, or from the use of any hardware or software described in this document, even if ABB or its suppliers have been advised of the possibility of such damages. This document and parts hereof must not be reproduced or copied without written permission from ABB, and the contents hereof must not be imparted to a third party nor used for any unauthorized purpose. All rights to registrations and trademarks reside with their respective owners.
\n\n
Frequently Asked Questions
\n
What is the scope of the vulnerability? - An attacker who successfully exploited these vulnerabilities could insert and run arbitrary code in the S+ system. What causes the vulnerability? - It is caused by several vulnerabilities in the PostgreSQL version 13.11 and earlier versions component used by the S+ Engineering product (see Affected products). What might an attacker use the vulnerability to do? - An attacker who successfully accessed the site\u2019s S+ client/server network could cause a denial-of-service situation, corruptions of data or unauthorized disclosure of information. How could an attacker exploit the vulnerability? - To exploit the PostgreSQL vulnerabilities (see Vulnerability severity and details), an attacker should successfully access to the site\u2019s S+ client/server network, remotely (through a wrongly configured or penetrated firewall) or even compromising a local machine and then accessing to PostgreSQL. Recommended practices help mitigate such attacks, see section Mitigating Factors above. Could the vulnerability be exploited remotely? - Yes, see the above How could an attacker exploit the vulnerability? Recommended practices include that process control systems are physically protected, have no direct connections to the Internet, and are separated from other networks by means of a firewall system that has a minimal number of ports exposed. Can functional safety be affected by an exploit of this vulnerability? - Functional safety systems are not affected by these vulnerabilities What does the update do? - The S+ Engineering update removes the vulnerability by installing a secure updated PostgreSQL version. When this security advisory was issued, had this vulnerability been publicly disclosed? - Yes, PostgreSQL 13.11 vulnerabilities have been publicly disclosed. When this security advisory was issued, had ABB received any reports that this vulnerability was being exploited? - No, ABB had not received any information indicating that S+ Engineering had been exploited when this security advisory was originally issued.
\n\n
Legal Notice and Terms of Use
\n
This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
\n\n
Recommended Practices
\n
CISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability.
\n
Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.
\n
Locate control system networks and remote devices behind firewalls and isolate them from business networks.
\n
When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.
\n
CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
\n
CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
\n
CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
\n
Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
\n\n
Advisory Conversion Disclaimer
\n
This ICSA is a verbatim republication of ABB PSIRT 7PAA017341 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided \"as-is\" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact ABB PSIRT directly for any questions regarding this advisory.
\n
Revision History
\n
\n
Initial Release Date: 2026-04-13
\n
\n
\n\n
\n
Date
\n
Revision
\n
Summary
\n
\n\n\n
\n
2026-04-13
\n
1
\n
Initial version.
\n
\n
\n
2026-04-30
\n
2
\n
Initial CISA Republication of ABB PSIRT 7PAA017341 advisory
Successful exploitation of this vulnerability could allow an attacker to send specially crafted messages to the system node resulting in execution of arbitrary code.
\n
The following versions of ABB PCM600 are affected:
\n
\n
PCM600 >=1.5|<=2.13
\n
\n
\n
\n\n
\n
CVSS
\n
Vendor
\n
Equipment
\n
Vulnerabilities
\n
\n\n\n
\n
v3 4.4
\n
ABB
\n
ABB PCM600
\n
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
A vulnerability exists in the SharpZip.dll included in the product versions listed above. An attacker could exploit vulnerability by providing a specially crafted message to the system node, causing insertion, and running of arbitrary code.
Vendor fix The problem is corrected in the following product version: ABB Protection and control IED manager PCM600 version 2.14. ABB recommends that customers apply the update at earliest convenience.
\n
Vendor fix Note: RE_630 protection relays are not compatible with PCM600 version 2.14. When using earlier PCM600 versions with RE_630, the known vulnerability must be mitigated through system-level defenses. For mitigation guidance, refer to the General Security Recommendations.
\n
Vendor fix The following product versions have been fixed: Protection and Control IED manager PCM600 2.14 is a fixed version for CVE-2018-1002208
Mitigation For more information see the associated ABB PSIRT security advisory 2NGA002813 ABB CYBERSECURITY ADVISORY - PDF version (https://search.abb.com/library/Download.aspx?DocumentID=2NGA002813&LanguageCode=en&DocumentPartId=pdf&Action=Launch), ABB CYBERSECURITY ADVISORY - CSAF version (https://psirt.abb.com/csaf/2025/2nga002813.json). https://psirt.abb.com/csaf/2025/2nga002813.json
This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
\n\n
Recommended Practices
\n
CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability.
\n
Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.
\n
Locate control system networks and remote devices behind firewalls and isolating them from business networks.
\n
When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs). Recognize VPNs may have vulnerabilities, should be updated to the most recent version available, and are only as secure as the connected devices.
\n
CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
\n
CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
\n
CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.
\n
Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
\n
Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
\n
CISA also recommends users take the following measures to protect themselves from social engineering attacks:
\n
Do not click web links or open attachments in unsolicited email messages.
\n
Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.
\n
Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.
\n
No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time. This vulnerability is not exploitable remotely. This vulnerability has a high attack complexity.
Although BOD 22-01 only applies to FCEB agencies, CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of KEV Catalog vulnerabilities as part of their vulnerability management practice. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.
This vulnerability was privately reported relating to ABB\u2019s implementation of the IEC 61850 communication stack for MMS client applications used in some Automation control system products. Note: IEC 61850 communication typically supports MMS and GOOSE protocols. Some ABB products support both, others only MMS (e.g. S+ Operations and PM 877). In any case, GOOSE communication is not impacted by this reported vulnerability. If an attacker gains access to a site\u2019s IEC 61850 network, then exploiting this vulnerability will result in a device fault (PM 877, CI850 and CI868 modules) and will require a manual restart. If this attack is directed at a S+ Operations node running IEC 61850 connectivity, this will result in a crash in the IEC 61850 communication driver which, if continued a repeating basis, will also result in a denial-of-service situation. Note that this does not have an impact on the overall availability and functionality of the S+ Operations node, only the IEC 61850 communication function. The System 800xA IEC61850 Connect is not affected.
\n
The following versions of ABB System 800xA, Symphony Plus IEC 61850 are affected:
A vulnerability exists in the command handling of the IEC 61850 communication stack included in the product revisions listed above. An attacker with access to IEC 61850 networks could exploit the vulnerability by using a specially crafted 61850 packet, forcing the communication interfaces of the PM 877, CI850 and CI868 modules into fault mode or causing unavailability of the S+ Operations 61850 connectivity, resulting in a denial-of-service situation. The System 800xA IEC61850 Connect is not affected. Note: This vulnerability does not impact on the overall availability and functionality of the S+ Operations node, only the 61850 communication function.
Vendor fix ABB advises all customers to review their installations to determine if they are using an impacted product as listed above, no further analysis or tools are needed to make this determination. The recommended immediate actions per product are listed below: - CI868 (for AC 800M) Devices with firmware versions reported in Affected products are vulnerable. All the vulnerabilities will be corrected in 6.1.1 and 7.0 tracks for 800xA. AC 800M 6.1.1-3 is planned for Q2 2027, AC 800M 7.0 has been released in December 2025. - CI850 (for Symphony Plus SD Series) Devices with firmware versions reported in Affected products are vulnerable. All the vulnerabilities will be corrected in version C_0 or later (planned Q2 2026). - PM 877 (Symphony Plus MR) Devices with firmware versions reported in Affected products are vulnerable. All the vulnerabilities will be corrected with firmware version 3.53 or later (planned Q1 2026). - S+ Operations Versions reported in Affected products are vulnerable. All the vulnerabilities will be corrected in version 3.4 or later (released in January 2026). ABB recommends customers apply updates, as they become available, at their earliest convenience. It is also advisable to review the Mitigating Factors, Workarounds and General security recommendations sections for additional actions which may help reduce overall risk.
\n
Mitigation The vulnerabilities announced in this Advisory for ABB Process Automation products require that an attacker has access to the system network and hosts which are generally expected to be protected. Process Control and IEC 61850 networks are NOT recommended to be exposed directly to Internet connections. If these networks are not properly isolated, then connected components may be remotely exploitable as described in this advisory. To exploit the vulnerability, an attacker with remote network access can send a specially crafted packet to the PM 877, CI850 and CI868 modules which causes the fault of these devices. S+ Operations only implements 61850 client services and therefore are not intended to listen to in-coming connection requests. However, if a specially crafted message is sent anyway, it can still cause the 61850-communication driver to crash. The usage of a perimeter firewall to allow legitimate client communications is an effective mitigation. Refer to section \u201cGeneral security recommendations\u201d for further advise on how to keep your system secure.
\n
Workaround No workarounds are available. Assess the installation specific risk based on this advisory. Use the recommendations described under \u201cMitigating factors\u201d or \u201cRecommended immediate actions\u201d.
Hitachi Energy reported this vulnerability to ABB Global.
\n
ABB Global reported this vulnerability to CISA.
\n
\n\n
Notice
\n
The information in this document is subject to change without notice, and should not be construed as a commitment by ABB. ABB provides no warranty, express or implied, including warranties of merchantability and fitness for a particular purpose, for the information contained in this document, and assumes no responsibility for any errors that may appear in this document. In no event shall ABB or any of its suppliers be liable for direct, indirect, special, incidental or consequential damages of any nature or kind arising from the use of this document, or from the use of any hardware or software described in this document, even if ABB or its suppliers have been advised of the possibility of such damages. This document and parts hereof must not be reproduced or copied without written permission from ABB, and the contents hereof must not be imparted to a third party nor used for any unauthorized purpose. All rights to registrations and trademarks reside with their respective owners.
\n\n
Frequently Asked Questions
\n
What is the scope of the vulnerability? - An attacker having access to the IEC 61850 network can force the ABB hardware devices to go to \u2018fault\u2019 state by sending a specially crafted 61850 packet. This will result in a denial-of-service situation affecting the primary functionality of the listed devices and requiring a manual reset. In the same way this vulnerability can cause the unavailability of the S+ Operations 61850 connectivity, if continued on a repeating basis (but not the whole S+ Operations node). The System 800xA IEC61850 Connect is not affected. What causes the vulnerability? - The vulnerability is caused by a weakness in the message processing in the IEC 61850 communication stack. What is CI868? - CI868 is a module used in AC800M product line (System 800xA) for IEC 61850 communication. What is CI850? - CI868 is a module used in Symphony Plus SD Series product line for IEC 61850 communication. What is PM 877? - PM 877 is a controller used in Symphony Plus MR (Melody Rack) product line for IEC 61850 communication. What is S+ Operations? - S+ Operations is the Human Machine Interface for supervision and control of Symphony based control or SCADA systems. It is a module used in AC800M product line (System 800xA) for IEC 61850 communication. What might an attacker use the vulnerability to do? - An attacker with access to IEC 61850 networks could exploit the vulnerability by sending a specially crafted 61850 packet to the S+ products, forcing the Communication Interfaces to fault modes or causing unavailability of the S+ Operations 61850 connectivity, resulting in a denial-of-service situation. How could an attacker exploit the vulnerability? - An attacker could try to exploit the vulnerability by creating a specially crafted message and sending the message to an affected system node. This would require that the attacker has access to the system network, by connecting to the network either directly or through a wrongly configured or penetrated firewall, or that he installs malicious software on a system node or otherwise infects the net-work with malicious software. Recommended practices help mitigate such attacks, see section Mitigating Factors. Could the vulnerability be exploited remotely? - Yes, an attacker who has network access to an affected system node could exploit this vulnerability. Recommended practices include that process control systems are physically protected, have no direct connections to the Internet, and are separated from other networks by means of a firewall system that has a minimal number of ports exposed. Can functional safety be affected by an exploit of this vulnerability? - Functional safety systems are not affected by these vulnerabilities. What does the update do? - The update removes the vulnerability by modifying the way that the IEC 61850 stack, used by the ABB Process Automation Products described above, manages 61850 incoming messages. When this security advisory was issued, had this vulnerability been publicly disclosed? - No, ABB received information about this vulnerability through responsible disclosure. When this security advisory was issued, had ABB received any reports that this vulnerability was being exploited? - No, ABB had not received any information indicating that this vulnerability had been exploited when this security advisory was originally issued.
\n\n
Legal Notice and Terms of Use
\n
This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
\n\n
Recommended Practices
\n
CISA recommends users take defensive measures to minimize the exploitation risk of these vulnerabilities.
\n
Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.
\n
Locate control system networks and remote devices behind firewalls and isolate them from business networks.
\n
When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.
\n
CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
\n
CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
\n
CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
\n
Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
\n\n
Advisory Conversion Disclaimer
\n
This ICSA is a verbatim republication of ABB PSIRT 7PAA020125 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided \"as-is\" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact ABB PSIRT directly for any questions regarding this advisory.
\n
Revision History
\n
\n
Initial Release Date: 2026-04-13
\n
\n
\n\n
\n
Date
\n
Revision
\n
Summary
\n
\n\n\n
\n
2026-04-13
\n
1
\n
Initial version.
\n
\n
\n
2026-04-30
\n
2
\n
Initial CISA Republication of ABB PSIRT 7PAA020125 advisory
Successful exploitation of this vulnerability could allow an attacker to send a specially crafted message to the system node allowing the attacker to install and run arbitrary code, uninstall applications, and modify the configuration of installed applications.
\n
The following versions of ABB Edgenius Management Portal are affected:
\n
\n
Edgenius Management Portal 3.2.0.0|3.2.1.1
\n
\n
\n
\n\n
\n
CVSS
\n
Vendor
\n
Equipment
\n
Vulnerabilities
\n
\n\n\n
\n
v3 9.6
\n
ABB
\n
ABB Edgenius Management Portal
\n
Authentication Bypass Using an Alternate Path or Channel
\n
\n\n
\n
\n
Background
\n
\n
Critical Infrastructure Sectors: Critical Manufacturing, Information Technology
The Edgenius Management Portal in the affected product versions contains a vulnerability that allows authentication to be bypassed. An attacker could exploit the vulnerability by sending a specially crafted message to the system node allowing the attacker to install and run arbitrary code, uninstall in-stalled applications and modify the configuration of installed applications.
Vendor fix ABB has prepared an update to fix this vulnerability included in the latest Roll-Up, ABB Ability Edgenius version 3.2.2.0. ABB advises customers to upgrade as soon as possible. Until the upgrade is applied, ABB advises customers to disable the Edgenius Management Portal to mitigate the vulnerability.
\n
Vendor fix All affected products: Exploitation requires an attacker to have gained access to the network where Edgenius has been deployed, and while the Edgenius Management Portal is running. Refer to section \"General security recommendations\" for further advise on how to keep your system secure.
\n
Mitigation All affected products: Workarounds are specific measures that a user can take to help block an attack, for example, temporarily disabling the vulnerable feature may remove the exposure with well-known impact on functionality. ABB has tested the following workaround.
\n
Mitigation The following product versions have been fixed: Ability Edgenius 3.2.2.0 is a fixed version for CVE-2025-10571
\n
Mitigation For more information see the associated ABB PSIRT security advisory 7PAA022088 ABB CYBERSECURITY ADVISORY - PDF version (https://search.abb.com/library/Download.aspx?DocumentID=7PAA022088&LanguageCode=en&DocumentPartId=&Action=Launch), ABB CYBERSECURITY ADVISORY - CSAF version (https://psirt.abb.com/csaf/2025/7paa022088.json). https://search.abb.com/library/Download.aspx?DocumentID=7PAA022088&LanguageCode=en&DocumentPartId=&Action=Launch
\n
Mitigation For more information see the associated ABB PSIRT security advisory 7PAA022088 ABB CYBERSECURITY ADVISORY - PDF version (https://search.abb.com/library/Download.aspx?DocumentID=7PAA022088&LanguageCode=en&DocumentPartId=&Action=Launch), ABB CYBERSECURITY ADVISORY - CSAF version (https://psirt.abb.com/csaf/2025/7paa022088.json). https://psirt.abb.com/csaf/2025/7paa022088.json
This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
\n\n
Recommended Practices
\n
CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability.
\n
Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.
\n
Locate control system networks and remote devices behind firewalls and isolating them from business networks.
\n
When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs). Recognize VPNs may have vulnerabilities, should be updated to the most recent version available, and are only as secure as the connected devices.
\n
CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
\n
CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
\n
CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.
\n
Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
\n
Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
\n
CISA also recommends users take the following measures to protect themselves from social engineering attacks:
\n
Do not click web links or open attachments in unsolicited email messages.
\n
Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.
\n
Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.
\n
No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time. This vulnerability is not exploitable remotely.
CISA, in coordination with the Department of War, Department of Energy, Federal Bureau of Investigation, and Department of State, released Adapting Zero Trust Principles to Operational Technology, joint guidance for organizations applying zero trust (ZT) principles to operational technology (OT). Zero trust is a modern, adaptive approach to cybersecurity that eliminates implicit trust and requires continuously validating access based on identity, context, and risk.
\n
With advancements in technology, OT systems that were traditionally isolated or manually operated are now increasingly interconnected, digitally monitored, and remotely controlled. This IT-OT convergence introduces new cybersecurity risks that make perimeter-based defenses and implicit trust models inadequate for safeguarding OT systems and the critical physical processes they control.
\n
This guidance supports OT owners and operators in addressing the unique challenges of transitioning to a ZT architecture, considering technology gaps from legacy infrastructure, operational constraints, and safety requirements. It focuses on establishing comprehensive asset visibility, proactively addressing supply chain risks, and implementing robust identity and access management while stressing the importance of layered security measures\u2014including network segmentation, secure communication protocols, and vulnerability management.
\n
To learn more about ZT principles, visit Zero Trust
Although BOD 22-01 only applies to FCEB agencies, CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of KEV Catalog vulnerabilities as part of their vulnerability management practice. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.
A vulnerability in GRASSMARLIN v3.2.1 allows crafted session data to trigger improper handling of XML input, which may result in unintended exposure of sensitive information. The flaw stems from insufficient hardening of the XML parsing process.
Vendor fix NSA has indicated that the GRASSMARLIN project has reached end-of-life status as of 2017 and is no longer supported. The project is archived, and no patches or further updates are planned or expected.
This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
\n\n
Recommended Practices
\n
CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability.
\n
Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.
\n
Locate control system networks and remote devices behind firewalls and isolating them from business networks.
\n
When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.
\n
CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
\n
CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
\n
CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.
\n
Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
\n
Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
\n
CISA also recommends users take the following measures to protect themselves from social engineering attacks:
\n
Do not click web links or open attachments in unsolicited email messages.
\n
Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.
\n
Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.
\n
No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time.
Although BOD 22-01 only applies to FCEB agencies, CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of KEV Catalog vulnerabilities as part of their vulnerability management practice. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.
Defending against China-nexus covert networks of compromised devices
\n
Explaining the widespread shift in tactics, techniques and procedures (TTPs) towards networks of compromised infrastructure, and how to defend against it
\n
Summary
\n
With support from the UK Cyber League, this advisory has been jointly released by the National Cyber Security Centre (NCSC-UK) and international partners:
\n
\n
Australian Signals Directorate\u2019s (ASD\u2019s) Australian Cyber Security Centre (ACSC)
\n
Communications Security Establishment Canada\u2019s (CSE\u2019s) Canadian Centre for Cyber Security (Cyber Centre)
\n
Germany Federal Office for the Protection of the Constitution - Bundesamt f\u00fcr Verfassungsschutz (BfV)
\n
Germany Federal Intelligence Service \u2013 Bundesnachrichtendienst (BND)
\n
Germany Federal Office for Information Security - Bundesamt f\u00fcr Sicherheit in der Informationstechnik (BSI)
\n
Japan National Cybersecurity Office (NCO) - \u56fd\u5bb6\u30b5\u30a4\u30d0\u30fc\u7d71\u62ec\u5ba4
\n
Netherlands General Intelligence and Security Service - Algemene Inlichtingen- en Veiligheidsdienst (AIVD)
\n
Netherlands Defence Intelligence and Security Service - Militaire Inlichtingen- en Veiligheidsdienst (MIVD)
\n
New Zealand National Cyber Security Centre (NCSC-NZ)
\n
Spain National Cryptologic Centre \u2013 Centro Criptol\u00f3gico Nacional (CCN)
\n
Sweden National Cyber Security Centre - Nationellt cybers\u00e4kerhetscenter (NCSC-SE)
\n
United States Cybersecurity and Infrastructure Security Agency (CISA)
\n
United States Department of Defense Cyber Crime Center (DC3)
\n
United States Federal Bureau of Investigation (FBI)
\n
United States National Security Agency (NSA)
\n
\n
Its purpose is to provide network defenders with the tools needed to defend against China-nexus cyber actors and their tactic of using large scale networks of compromised devices (covert networks) to route their cyber activity.
\n
Introduction
\n
Over the past few years there has been a major shift in the tactics, techniques and procedures (TTPs) used by China-nexus cyber actors, moving away from the use of individually procured infrastructure, and towards the use of externally provisioned, large-scale networks of compromised devices.
\n
\n
The NCSC believes that the majority of China-nexus threat actors are using these networks (hereafter \u201ccovert networks\u201d), that multiple covert networks have been created and are being constantly updated, and that a single covert network could be being used by multiple actors. These networks are mainly made up of compromised Small Office Home Office (SOHO) routers, as well as Internet of Things (IoT) and smart devices.
The use of covert networks of compromised devices - also known as botnets - to facilitate malicious cyber activity is not new, but China-nexus cyber actors are now using them strategically, and at scale.
\n
\n
\n
This advisory describes the typical makeup of a covert network and what they are being used for. It also includes protective advice for organizations being targeted by cyber activity using a covert network as an access vector.
\n
Covert Networks
\n
Covert networks are used to connect across the internet in a low-cost, low-risk, deniable way, disguising the origin and attribution of malicious activity. Actors have been observed using them for each phase of their Cyber Kill Chains, from performing scans as part of reconnaissance, to the delivery of malware, communicating with said malware, and exfiltrating stolen data from a victim. They can also be used for general deniable internet browsing, allowing threat actors to research exploitation techniques, new TTPs, and their victims without attribution. Some covert networks are also used by legitimate customers to browse the internet, making it challenging to attribute malicious activity.
\n
\n
There is evidence that covert networks used by China-nexus actors are created and maintained by Chinese information security companies. A network known to network defenders as Raptor Train, which in 2024 infected more than 200,000 devices worldwide, was controlled and managed by the Chinese company, Integrity Technology Group. This company was also assessed by the FBI to be responsible for the computer intrusion activities attributed to China-based hackers known as Flax Typhoon.
\n
\n
\n
\n
Botnet operations represent a significant threat to the UK by exploiting vulnerabilities in everyday internet-connected devices with the potential to carry out large-scale cyber attacks \u2013 NCSC Director of Operations, Paul Chichester
\n
\n
\n
\n
Covert networks mostly consist of compromised SOHO routers, but they also pull in any vulnerable device they can exploit at scale. Raptor Train was made up of thousands of SOHO routers and IoT devices, such as web cameras and video recorders, as well as firewalls and Network Attached Storage (NAS) devices.\u202fThe KV Botnet used by Volt Typhoon was mainly made up of vulnerable Cisco and NetGear routers. The edge devices were vulnerable because they were \u201cend of life\u201d \u2013 out of date and no longer receiving updates or security patches by their manufacturers.
\n
\n
\n
The cyber security industry has been aware of examples of these networks for some time and has publicly reported on the widespread scale of the threat and its implications. Mandiant Intelligence produced a public blog in May 2024 talking about covert networks in which they highlighted a key issue for defenders \u2013 indicator of compromise (IOC) Extinction. If a particular threat group could now come from one of many covert networks, each with potentially hundreds of thousands of endpoints, and each used by multiple threat actors, old network defense paradigms of static malicious IP block lists will be less effective. This is compounded by the dynamic nature of these networks where new nodes will be added as old devices are patched or removed from use.
\n
Typical Network Topology
\n
The number of covert networks used by China-nexus cyber actors is large, with new networks regularly developed and deployed. The existing covert networks change too, either because of defensive or legal action, or simply as a result of software updates and new exploits being used to target different technologies for incorporation into the network.
\n
\n
Because of this, a description of all known covert networks in detail, including how they are constructed and how they communicate, would immediately be out of date \u2013 and for most network defenders would not be practically useful.
\n
\n
\n
However, most covert networks of compromised devices use the same basic set up. Understanding this generalized structure can aid researchers and defenders by helping them to understand which part of a network they may have found, and how to defend against it.
\n\n\n\n\n \n
\n\n\n\n
\n A diagram illustrating the basic setup of a covert network.\n \n
\n
The diagram above illustrates the basic setup of a covert network, where typically an actor will connect to the network via an on-ramp or entry node. Their traffic will be forwarded through multiple compromised devices, used as traversal nodes, before exiting the network from an exit node, usually in the same geographic region as the target.
\n
Protective Advice
\n
Defending from attackers using covert networks is not straightforward, and defensive tactics will be different based on the levels of resource and the nature of the target organization. General advice for good cyber security practice should be followed, and some key messages can be found in the appendix of this advisory.
\n
\n
\n
The following advice is specifically tailored to steps which can be taken to combat the risk of attacks coming from large, dynamic networks of compromised devices.
\n
\n
\n
Further guidance for all organizations facing cyber security threats is available on the NCSC website.
\n
This guidance should be considered alongside all applicable laws and regulations of the UK and co-sealing countries relating to the security of networks and data. It will be each organization\u2019s responsibility to ensure compliance with any such laws and regulations. Organizations should note that following the recommended actions set out below will not remove all risks.
\n
All organizations
\n
\n
The NCSC recommends the following steps for all affected organizations to either take themselves, or ask their managed service and/or security providers to investigate for them:
\n
\n
Map and understand network edge devices, developing a clear understanding of organizational assets and what should be connecting to them.
\n
Baseline normal connections, especially to corporate virtual private networks (VPNs) or other similar services.\n
\n
Would you expect connections from consumer broadband ranges?
\n
\n
\n
Leverage available dynamic threat feeds which include covert network infrastructure.
\n
Implement multifactor authentication for remote connections.
Some more comprehensive measures may be appropriate if the risk to an organization is high enough, to be conducted either in-house or through a security provider:
\n
\n
Apply IP address allow lists rather than deny lists for connections to corporate VPNs for remote workers.
\n
Use geographic allow lists or profile incoming connections based on operating system, time zones, and/or organization specific system configuration settings.
\n
Implement zero trust policies for connections.
\n
Enforce machine certificates for Secure Sockets Layer (SSL) connections.
\n
Reduce the internet-facing presence of the IT estate.
\n
Investigate machine learning techniques to profile normal network edge activity to detect and block anomalies.
If Advanced Persistent Threat (APT) tracking is part of an organization\u2019s in-house capability, or if it is part of the service provided by a security vendor, consider tracking China-nexus covert networks as APTs in their own right.
\n
\n
Active hunting \u2013 look for connections from IP addresses likely to be part of a covert network of compromised devices, for instance those hosting SOHO routers or IoT devices.
\n
Track and map covert networks reported by industry or government by looking at banners and certificates.
\n
Use threat reporting and threat feeds to create and implement dynamic blocklists and create alert rules to detect incoming threats.
\n
Consider using NetFlow feeds to look upstream and map covert networks to find new nodes.
\n
\n
The NCSC Cyber Assessment Framework provides guidance for organizations under the highest levels of threat, including those operating essential services, in sectors such as energy, healthcare, transport, digital infrastructure and government.\u202f
\n
MITRE ATT&CK\u00ae
\n
This advisory has been compiled with respect to the MITRE ATT&CK\u00ae framework, a globally accessible knowledge base of adversary tactics and techniques based on real-world observations.
In addition to the protective advice outlined in this advisory, a number of cyber security best practices will also be useful in defending against the activity described in this advisory.
This report draws on information derived from NCSC and industry sources. Any NCSC findings and recommendations made have not been provided with the intention of avoiding all risks and following the recommendations will not remove all such risk. Ownership of information risks remains with the relevant system owner at all times. Any reference to specific commercial entities, products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favoring by co-sealers. UK readers should refer to the NCSC website for information about NCSC assured services.
\n
\n
\n
\n
This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information legislation.
![\"A](\"https://www.cisa.gov/sites/default/files/styles/large/public/2026-04/A%20diagram%20illustrating%20the%20basic%20setup%20of%20a%20covert%20network..png?itok=3Bfm4nKj\")
\n\n\n\n