CVE-2024-48849

🗓️ 29 Jan 2025 18:23:59Reported by ABBType

cve🔗 web.nvd.nist.gov👁 59 Views🌐 WEB

Missing Origin Validation in WebSockets in FLXEON allows unauthorized HTTPS requests up to version 9.3.4.

Reporter	Title	Published	Views	Family All 13
0day.today	ABB Cylon FLXeon 9.3.4 wsConnect.js WebSocket Command Spawning Exploit	9 Feb 202500:00	–	zdt
BDU FSTEC	The vulnerability of microprogrammed software for programmable logic controllers ABB FBXi, FBVi, FBTi, and CBXi lies in the lack of origin verification in WebSockets. This allows attackers to circumvent security restrictions and gain unauthorized access to protected information.	10 Feb 202500:00	–	bdu_fstec
Circl	CVE-2024-48849	28 Jan 202515:33	–	circl
CNNVD	ABB FLXeon 安全漏洞	29 Jan 202500:00	–	cnnvd
CNVD	ABB FLXeon Security Bypass Vulnerability	17 Feb 202500:00	–	cnvd
Cvelist	CVE-2024-48849 Authentication and Authorization Issues	29 Jan 202518:23	–	cvelist
Exploit DB	ABB Cylon FLXeon 9.3.4 - WebSocket Command Spawning	11 Apr 202500:00	–	exploitdb
EUVD	EUVD-2024-43246	3 Oct 202520:07	–	euvd
NVD	CVE-2024-48849	29 Jan 202519:15	–	nvd
Packet Storm	ABB Cylon FLXeon 9.3.4 wsConnect.js WebSocket Command Spawning	7 Feb 202500:00	–	packetstorm

[
  {
    "defaultStatus": "unaffected",
    "product": "FLXEON",
    "vendor": "ABB",
    "versions": [
      {
        "lessThanOrEqual": "<= 9.3.4",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
search	www.search.abb.com/library/Download.aspx

Parameter	Position	Path	Description	CWE
Origin	header	/ws	Unauthenticated WebSocket interface with missing origin validation allowing unauthorized access and potential abuse (tcpdump spawns) as described in the advisory.	CWE-1385

17 Jun 2026 07:58Current

9.3High risk

Vulners AI Score9.3

CVSS 48.8

CVSS 3.19.4

EPSS0.00884

SSVC

CWE-1385