ABB Cylon FLXeon 9.3.4 Limited Cross-Site Request Forgery (RCE)
Title: ABB Cylon FLXeon 9.3.4 Limited Cross-Site Request Forgery (RCE)
Advisory ID: ZSL-2025-5918
Type: Local/Remote
Impact: Cross-Site Scripting
Risk: (3/5)
Release Date: 11.02.2025
The FLXeon Controller Series uses BACnet/IP standards to deliver unprecedented connectivity and open integration for your building automation systems. It's scalable, and modular, allowing you to control a diverse range of HVAC functions.
Same Domain: The attacker must host the malicious page on the same domain as the target server.
Man-in-the-Middle (MitM): The attacker can intercept and modify traffic between the user and the server (e.g., on an unsecured network).
Local Area Network (LAN) Access: The attacker must have access to the same network as the target server.
Subdomains: The attacker can host the malicious page on a subdomain if the server allows it.
Misconfigured CORS: The server’s CORS policy is misconfigured to allow certain origins or headers.
Reflected XSS: The attacker can exploit a reflected XSS vulnerability to execute JavaScript in the context of the target origin.
CBX Series (FLX Series)
CBT Series
CBV Series
Firmware: <=9.3.4
Linux Kernel 4.15.13
NodeJS/8.4.0
Express
[22.04.2024] Vendor contacted.
[22.04.2024] Vendor responds.
[02.05.2024] Working with the vendor.
[20.01.2025] Vendor releases version 9.3.5 to address this issue.
[11.02.2025] Public security advisory released.
[2] https://packetstorm.news/files/id/189209/
[12.02.2025] - Added reference [2]
Web: https://www.zeroscience.mk
e-mail: lab@zeroscience.mk
Advisory ID: ZSL-2025-5918
Type: Local/Remote
Impact: Cross-Site Scripting
Risk: (3/5)
Release Date: 11.02.2025
Summary
BACnet® Smart Building Controllers. ABB's BACnet portfolio features a series of BACnet® IP and BACnet MS/TP field controllers for ASPECT® and INTEGRA™ building management solutions. ABB BACnet controllers are designed for intelligent control of HVAC equipment such as central plant, boilers, chillers, cooling towers, heat pump systems, air handling units (constant volume, variable air volume, and multi-zone), rooftop units, electrical systems such as lighting control, variable frequency drives and metering.The FLXeon Controller Series uses BACnet/IP standards to deliver unprecedented connectivity and open integration for your building automation systems. It's scalable, and modular, allowing you to control a diverse range of HVAC functions.
Description
A CSRF vulnerability has been identified in the ABB Cylon FLXeon series. However, exploitation is limited to specific conditions due to the server's CORS configuration (Access-Control-Allow-Origin: * without Access-Control-Allow-Credentials: true). The vulnerability can only be exploited under the following scenarios:Same Domain: The attacker must host the malicious page on the same domain as the target server.
Man-in-the-Middle (MitM): The attacker can intercept and modify traffic between the user and the server (e.g., on an unsecured network).
Local Area Network (LAN) Access: The attacker must have access to the same network as the target server.
Subdomains: The attacker can host the malicious page on a subdomain if the server allows it.
Misconfigured CORS: The server’s CORS policy is misconfigured to allow certain origins or headers.
Reflected XSS: The attacker can exploit a reflected XSS vulnerability to execute JavaScript in the context of the target origin.
Vendor
ABB Ltd. - https://www.global.abbAffected Version
FLXeon Series (FBXi Series, FBTi Series, FBVi Series)CBX Series (FLX Series)
CBT Series
CBV Series
Firmware: <=9.3.4
Tested On
Linux Kernel 5.4.27Linux Kernel 4.15.13
NodeJS/8.4.0
Express
Vendor Status
[21.04.2024] Vulnerability discovered.[22.04.2024] Vendor contacted.
[22.04.2024] Vendor responds.
[02.05.2024] Working with the vendor.
[20.01.2025] Vendor releases version 9.3.5 to address this issue.
[11.02.2025] Public security advisory released.
PoC
abb_flxeon_csrf1.htmlCredits
Vulnerability discovered by Gjoko Krstic - <gjoko@zeroscience.mk>References
[1] https://search.abb.com/library/Download.aspx?DocumentID=9AKK108470A5684&LanguageCode=en&DocumentPartId=PDF&Action=Launch[2] https://packetstorm.news/files/id/189209/
Changelog
[11.02.2025] - Initial release[12.02.2025] - Added reference [2]
Contact
Zero Science LabWeb: https://www.zeroscience.mk
e-mail: lab@zeroscience.mk
