Loading story…
ABB FLXeon controllers through version 9.3.5 are affected by a high-severity remote code execution vulnerability due to improper input validation. The flaw, tracked as CVE-2024-48851, allows remote attackers to execute arbitrary code on affected devices. ABB has released a security advisory and recommends updating to version 9.3.5 or later and applying all relevant patches.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
A high-severity entry for CVE-2025-57644 affecting the Accela Automation Platform was published, describing Java remote code execution, SSRF, and file write issues. No further synopsis or exploitation details are included in the source content.
Canada's Centre for Cyber Security referenced an ABB control systems security advisory identified as AV25-605. The provided content does not include further details on affected products, impact, or remediation.
A high-severity entry for CVE-2024-48851, described as a remote code execution vulnerability, was published in the referenced feed. No additional technical or vendor details are provided in the source content.
3 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecyber.gc.ca
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
ABB published a security advisory addressing a reflected cross-site scripting (XSS) vulnerability, identified as CVE-2021-22291, in its EIBPORT V3 KNX and EIBPORT V3 KNX GSM products. The vulnerability is present in versions of these products prior to 3.9.2. This security flaw is due to improper neutralization of input during web page generation, which allows attackers to inject malicious scripts into web pages viewed by other users. The vulnerability can be exploited remotely, increasing the risk for organizations using affected ABB EIBPORT devices in their environments. The Common Vulnerability Scoring System (CVSS) rates this issue as high severity, with a score of 8.5, indicating significant potential impact if exploited. The Canadian Centre for Cyber Security issued an alert encouraging users and administrators to review ABB’s advisory and implement the recommended mitigations. ABB’s advisory provides technical details about the vulnerability and affected product versions, emphasizing the need for prompt updates to version 3.9.2 or later. The vulnerability could allow attackers to execute arbitrary scripts in the context of a user’s browser session, potentially leading to information theft, session hijacking, or further compromise of the affected system. No specific incidents of exploitation have been reported, but the public disclosure and remote exploitability heighten the urgency for remediation. ABB’s security team is the source of the vulnerability information, and they have coordinated the disclosure to ensure customers are informed. The advisory does not list specific affected product serial numbers but confirms the vulnerability applies to all EIBPORT V3 KNX and EIBPORT V3 KNX GSM devices running firmware prior to 3.9.2. Organizations are advised to update their devices as soon as possible and to review their web application security controls. The vulnerability highlights the ongoing risks associated with web-based management interfaces in industrial control systems. ABB’s response demonstrates a commitment to transparency and customer protection. The Canadian Centre for Cyber Security’s involvement underscores the importance of this issue for critical infrastructure operators. Timely patching and adherence to vendor guidance are essential to mitigate the risk posed by this XSS vulnerability.
Jun 29, 2026
CISA republished ABB advisories warning of serious vulnerabilities in **ABB Edgenius Management Portal** and **ABB AWIN Gateways**, affecting products used in critical manufacturing environments worldwide. The most severe issue impacts Edgenius Management Portal versions `3.2.0.0` and `3.2.1.1`, where a **CWE-288 authentication bypass** with a **CVSS v3.1 score of 9.6** could let an attacker send specially crafted messages to a system node to install and execute arbitrary code, uninstall applications, and alter application configurations. ABB AWIN GW100 rev.2 and AWIN GW120 devices running firmware versions `2.0-0`, `2.0-1`, `1.2-0`, and `1.2-1` are also affected by multiple flaws, including authentication bypass by capture-replay and missing authentication for critical functions.
Jun 29, 2026
A critical out-of-bounds write vulnerability, tracked as CVE-2025-53524, has been identified in Fuji Electric Monitouch V-SFT software. The flaw exists in the parsing of V7 project files, where insufficient validation of user-supplied data can result in a write past the end of an allocated buffer or object. Successful exploitation requires user interaction, such as opening a malicious file or visiting a crafted web page, and can allow attackers to execute arbitrary code in the context of the current process. The vulnerability has been assigned a CVSS score of 7.8 to 8.4, indicating high severity, and affects multiple versions of the Monitouch V-SFT product line. Fuji Electric has released an update to address this vulnerability, and users are strongly advised to apply the patch as soon as possible. The issue was reported to the vendor in July 2025 and publicly disclosed in December 2025 through coordinated advisories. Security researchers, including Rocco Calvi of TecSecurity, are credited with discovering the flaw. No evidence of remote exploitation without user interaction has been reported, but the vulnerability poses a significant risk to organizations using the affected software in industrial environments.
Jun 29, 2026