ABB Cylon FLXeon 9.3.4 Default Credentials
Title: ABB Cylon FLXeon 9.3.4 Default Credentials
Advisory ID: ZSL-2025-5919
Type: Local/Remote
Impact: System Access, Exposure of System Information, Exposure of Sensitive Information, DoS
Risk: (5/5)
Release Date: 13.02.2025
The FLXeon Controller Series uses BACnet/IP standards to deliver unprecedented connectivity and open integration for your building automation systems. It's scalable, and modular, allowing you to control a diverse range of HVAC functions.
CBX Series (FLX Series)
CBT Series
CBV Series
ABB UC32 Series Main Plant Controllers (Cylon's UnitronUC32.xx)
Firmware: <=9.3.4
Linux Kernel 4.15.13
NodeJS/8.4.0
Express
[22.04.2024] Vendor contacted.
[22.04.2024] Vendor responds.
[02.05.2024] Working with the vendor.
[20.01.2025] Vendor releases version 9.3.5 to address this issue.
[13.02.2025] Public security advisory released.
[2] https://packetstorm.news/files/id/189230/
Web: https://www.zeroscience.mk
e-mail: lab@zeroscience.mk
Advisory ID: ZSL-2025-5919
Type: Local/Remote
Impact: System Access, Exposure of System Information, Exposure of Sensitive Information, DoS
Risk: (5/5)
Release Date: 13.02.2025
Summary
BACnet® Smart Building Controllers. ABB's BACnet portfolio features a series of BACnet® IP and BACnet MS/TP field controllers for ASPECT® and INTEGRA™ building management solutions. ABB BACnet controllers are designed for intelligent control of HVAC equipment such as central plant, boilers, chillers, cooling towers, heat pump systems, air handling units (constant volume, variable air volume, and multi-zone), rooftop units, electrical systems such as lighting control, variable frequency drives and metering.The FLXeon Controller Series uses BACnet/IP standards to deliver unprecedented connectivity and open integration for your building automation systems. It's scalable, and modular, allowing you to control a diverse range of HVAC functions.
Description
The ABB Cylon FLXeon BACnet controller uses a weak set of default administrative credentials that can be guessed in remote password attacks and gain full control of the system.Vendor
ABB Ltd. - https://www.global.abbAffected Version
FLXeon Series (FBXi Series, FBTi Series, FBVi Series)CBX Series (FLX Series)
CBT Series
CBV Series
ABB UC32 Series Main Plant Controllers (Cylon's UnitronUC32.xx)
Firmware: <=9.3.4
Tested On
Linux Kernel 5.4.27Linux Kernel 4.15.13
NodeJS/8.4.0
Express
Vendor Status
[21.04.2024] Vulnerability discovered.[22.04.2024] Vendor contacted.
[22.04.2024] Vendor responds.
[02.05.2024] Working with the vendor.
[20.01.2025] Vendor releases version 9.3.5 to address this issue.
[13.02.2025] Public security advisory released.
PoC
abb_flxeon_default1.txtCredits
Vulnerability discovered by Gjoko Krstic - <gjoko@zeroscience.mk>References
[1] https://search.abb.com/library/Download.aspx?DocumentID=9AKK108470A5684&LanguageCode=en&DocumentPartId=PDF&Action=Launch[2] https://packetstorm.news/files/id/189230/
Changelog
[13.02.2025] - Initial releaseContact
Zero Science LabWeb: https://www.zeroscience.mk
e-mail: lab@zeroscience.mk
