99 matches found
ABB Cylon FLXeon 9.3.4 upload.js Authenticated Root Remote Code Execution
ABB Cylon FLXeon version 9.3.4 is vulnerable to an authenticated root command injection. An attacker can exploit the Backup-Restore feature via the /api/upload endpoint to execute arbitrary system commands as root. The issue arises due to improper input validation in upload.js, where user-supplie...
ABB Cylon FLXeon 9.3.4 (timeConfig.js) Authenticated Root Remote Code Execution
Summary BACnetยฎ Smart Building Controllers. ABB's BACnet portfolio features a series of BACnetยฎ IP and BACnet MS/TP field controllers for ASPECTยฎ and INTEGRAโข building management solutions. ABB BACnet controllers are designed for intelligent control of HVAC equipment such as central plant, boiler...
ABB Cylon FLXeon 9.3.4 (cmds.js) Authenticated Root Remote Code Execution
Summary BACnetยฎ Smart Building Controllers. ABB's BACnet portfolio features a series of BACnetยฎ IP and BACnet MS/TP field controllers for ASPECTยฎ and INTEGRAโข building management solutions. ABB BACnet controllers are designed for intelligent control of HVAC equipment such as central plant, boiler...
ABB Cylon FLXeon 9.3.4 (upload.js) Authenticated Root Remote Code Execution
Summary BACnetยฎ Smart Building Controllers. ABB's BACnet portfolio features a series of BACnetยฎ IP and BACnet MS/TP field controllers for ASPECTยฎ and INTEGRAโข building management solutions. ABB BACnet controllers are designed for intelligent control of HVAC equipment such as central plant, boiler...
CVE-2024-48849
Missing Origin Validation in WebSockets vulnerability in FLXEON. Session management was not sufficient to prevent unauthorized HTTPS requests. This issue affects FLXEON: through = 9.3.4...
CVE-2024-48849
CVE-2024-48849 affects ABB FLXeon devices (firmware
CVE-2024-48849 Authentication and Authorization Issues
Missing Origin Validation in WebSockets vulnerability in FLXEON. Session management was not sufficient to prevent unauthorized HTTPS requests. This issue affects FLXEON: through = 9.3.4...
CVE-2024-48849 Authentication and Authorization Issues
Missing Origin Validation in WebSockets vulnerability in FLXEON. Session management was not sufficient to prevent unauthorized HTTPS requests. This issue affects FLXEON: through = 9.3.4...
ABB FLXeon ๅฎๅ จๆผๆด
The ABB FLXeon is a series of controllers from ABB Switzerland. ABB FLXeon suffers from a security bypass vulnerability that stems from insufficient session management to prevent unauthorized HTTPS requests. No detailed vulnerability details are provided at this time...
ABB FLXeon ๆฅๅฟไฟกๆฏๆณ้ฒๆผๆด
The ABB FLXeon is a series of controllers from ABB Switzerland. ABB FLXeon version 9.3.4 and prior versions suffer from a log information disclosure vulnerability that stems from the application's inadequate protection of sensitive information and can be exploited by an attacker to obtain sensiti...
CVE-2024-48849: Missing Origin Validation in WebSockets
Missing Origin Validation in WebSockets vulnerability in FLXEON. Session management was not sufficient to prevent unauthorized HTTPS requests. This issue affects FLXEON: through = 9.3.4...
CVE-2024-48841
Network access can be used to execute arbitrary code with elevated privileges. This issue affects FLXEON 9.3.4 and older...
CVE-2024-48841 Remote Code Execution (RCE) Vulnerabilities
Network access can be used to execute arbitrary code with elevated privileges. This issue affects FLXEON 9.3.4 and older...
CVE-2024-48841 Remote Code Execution (RCE) Vulnerabilities
Network access can be used to execute arbitrary code with elevated privileges. This issue affects FLXEON 9.3.4 and older...
CVE-2024-48841
CVE-2024-48841 affects ABB Cylon FLXeon 9.3.4 and earlier. Multiple authenticated and unauthenticated remote code execution vectors are reported (examples: /api/users/password, /api/cert, /api/timeConfig, /api/cmds.js, /api/upload). The root cause across endpoints is improper input validation lea...
ABB FLXeon ๅฎๅ จๆผๆด
ABB FLXeon is a series of controllers from ABB Switzerland. A security vulnerability exists in ABB FLXeon version 9.3.4 and prior versions, which originates from a vulnerability that allows an attacker to execute arbitrary code and elevate privileges via network access...
CVE-2024-48841: Improper Neutralization of Special Elements used in a Command
Network access can be used to execute arbitrary code with elevated privileges. This issue affects FLXEON 9.3.4 and older...
ABB FLXEON Controllers
SUMMARY An update is available that resolves a privately reported vulnerability in the product versions listed as affected in this advisory. FLXEON devices are not intended to be internet-facing. A product advisory issued in June 2023 informed customers of this parameter. An attacker can...
PT-2025-2805 ยท Flxeon ยท Flxeon
Name of the Vulnerable Software and Affected Versions: FLXEON versions 9.3.4 and older Description: Network access can be used to execute arbitrary code with elevated privileges. This issue is related to incorrect handling of file names for PHP functions include or require, which may allow a remo...