📄 ABB Cylon FLXeon 9.3.5 variant.js Information Disclosure

The ABB Cylon FLXeon BACnet controller's /api/variant endpoint exposes sensitive system information, including the internal IP address, MAC address, device model, and build type, without requiring authentication. The get function gathers network interface data using the os.networkInterfaces API a...

ABB Cylon FLXeon 9.3.4 - Default Credentials

ABB Cylon FLXeon 9.3.4 Default Credentials Vendor: ABB Ltd. Product web page: https://www.global.abb Affected version: FLXeon Series FBXi Series, FBTi Series, FBVi Series CBX Series FLX Series CBT Series CBV Series ABB UC32 Series Main Plant Controllers Cylon's UnitronUC32.xx Firmware: =9.3.4...

ABB Cylon FLXeon 9.3.4 cert.js System Logs Information Disclosure

ABB Cylon FLXeon version 9.3.4 has an issue where an authenticated attacker can access sensitive information via the system logs page of ABB Cylon FLXeon controllers. The logs expose critical data, including the OpenSSL password for stored certificates. This information can be leveraged for furth...