CVE-2024-48841

An attacker with network access to the FLXEON device can send a specially crafted request that leads to execution of arbitrary system commands (command injection, CWE-77). The vulnerability does not require authentication, user interaction, or special attack conditions. Code execution occurs with elevated privileges, giving the attacker full control of the system.

An attacker can remotely take full control of the device by executing arbitrary code with elevated privileges, which may lead to violation of confidentiality, integrity, and availability of both the device itself and systems connected to it.

Apply patches available from the manufacturer according to references (ABB documentation number 9AKK108470A5684). Until the update is implemented, it is recommended to isolate FLXEON devices from untrusted networks and restrict network access to the minimum through firewall or network segmentation.

ABB FLXEON version 9.3.4 and earlier.