Multiple ABB ICS Vulnerabilities Enable Remote Code Execution

Executive Summary

Vulnerabilities span code execution, authentication bypass, denial of service and configuration disclosure in ABB control and gateway products. Exploitation can enable loss of control, unauthorized changes, device reboots and full engineering system compromise if network access is gained.

Key Details

Affected Platform

Attack Surface

Recommended Action

Apply vendor patch

Affected Environment

ABB industrial and ICS-connected products, including System 800xA, Symphony Plus, PCM600, Edgenius, OPTIMAX, AWIN and S+ Engineering. Impacted sites are those deploying listed firmware and software versions in operational and engineering environments.

Operational Impact

Systems may suffer denial of service on IEC 61850 connectivity, remote gateway reboots and unauthorized configuration changes. Engineering and management portals could be used to install, remove or alter applications, affecting reliability of control operations.

Technical Root Cause

Root causes include flaws in IEC 61850 command handling, SharpZip library, Edgenius auth logic, OPTIMAX auth algorithm and AWIN session handling. Further exposure comes from PostgreSQL 13.11 and earlier vulnerabilities embedded in Symphony Plus Engineering installations.

Recommended Mitigation

Identify all affected ABB products and versions; prioritize upgrades to the fixed releases specified for each product line.
Where updates are not yet possible, apply ABB’s recommended mitigations, including disabling Edgenius Portal until patched.

Concerned about your exposure?

Our security experts can help you assess affected systems, validate risk and support a safe remediation plan.

Discuss Your Security Exposure Explore MDR for OT

Assess your risk

Identify affected systems

Plan remediation

Practical, vendor-aligned guidance

Get expert support

From our 24/7 security team

Stay ahead of emerging threats

Get the latest threat intelligence and security advisories from Smarttech247.

Full Technical Report

Download the complete analysis, including detailed technical findings and references.

Download Full Report (PDF)

References

Use CISA ICS advisories ICSA-26-120-01 through ICSA-26-120-06 for official technical detail and remediation guidance. Track and map the listed CVEs to internal asset inventories to confirm exposure and remediation status.