ABB is aware of vulnerabilities in the product versions listed as affected in the advisory. FLXEON devices are not intended to be internet-facing. A product advisory issued in June 2023 informed customers of this parameter.

An attacker can successfully exploit these vulnerabilities and could take remote control of the product and potentially insert and run arbitrary code. ABB requires, as noted in previous security advisories and user documentation, that FLXEON should not be exposed to the internet or any other insecure network.

Note: In order to exploit an FLXEON, an attacker would need a misconfigured system.

ABB strongly advises customers and system integrators to follow the instructions documented in: FBXi, CBXi and ASPECT® SOLUTIONS, which can be downloaded from the ABB library.

Use of Hard-coded Credentials vulnerability in ABB FLXEON.This issue affects FLXEON: through 9.3.5 and newer versions

Use of Hard-coded Credentials vulnerability in ABB FLXEON.This issue affects FLXEON: through 9.3.5 and newer versions

Credentials that are required for the functioning of the product cannot be stored in a HW supported secure storage as the product does not implement such a component. A remote code execution is possible due to an improper input validation. Password hashes are stored using a vulnerable MD5 algorithm with low entropy on salt, stored in plain text on unencrypted partitions. Users can push files with full pathnames allowing file operations in off limits directories.