Headline
ABB Cylon FLXeon 9.3.4 (wsConnect.js) WebSocket Command Spawning PoC
The ABB Cylon FLXeon BACnet controller is vulnerable to an unauthenticated WebSocket implementation that allows an attacker to execute the tcpdump command. This command captures network traffic and filters it on serial ports 4855 and 4851, which are relevant to the device’s services. The vulnerability can be exploited in a loop to start multiple instances of tcpdump, leading to resource exhaustion, denial of service (DoS) conditions, and potential data exfiltration. The lack of authentication on the WebSocket interface allows unauthorized users to continuously spawn new tcpdump processes, amplifying the attack’s impact.
Title: ABB Cylon FLXeon 9.3.4 (wsConnect.js) WebSocket Command Spawning PoC
Advisory ID: ZSL-2025-5913
Type: Local/Remote
Impact: DoS
Risk: (5/5)
Release Date: 07.02.2025
Summary
BACnet® Smart Building Controllers. ABB’s BACnet portfolio features a series of BACnet® IP and BACnet MS/TP field controllers for ASPECT® and INTEGRA™ building management solutions. ABB BACnet controllers are designed for intelligent control of HVAC equipment such as central plant, boilers, chillers, cooling towers, heat pump systems, air handling units (constant volume, variable air volume, and multi-zone), rooftop units, electrical systems such as lighting control, variable frequency drives and metering.
The FLXeon Controller Series uses BACnet/IP standards to deliver unprecedented connectivity and open integration for your building automation systems. It’s scalable, and modular, allowing you to control a diverse range of HVAC functions.
Description
The ABB Cylon FLXeon BACnet controller is vulnerable to an unauthenticated WebSocket implementation that allows an attacker to execute the tcpdump command. This command captures network traffic and filters it on serial ports 4855 and 4851, which are relevant to the device’s services. The vulnerability can be exploited in a loop to start multiple instances of tcpdump, leading to resource exhaustion, denial of service (DoS) conditions, and potential data exfiltration. The lack of authentication on the WebSocket interface allows unauthorized users to continuously spawn new tcpdump processes, amplifying the attack’s impact.
Vendor
ABB Ltd. - https://www.global.abb
Affected Version
FLXeon Series (FBXi Series, FBTi Series, FBVi Series)
CBX Series (FLX Series)
CBT Series
CBV Series
Firmware: <=9.3.4
Tested On
Linux Kernel 5.4.27
Linux Kernel 4.15.13
NodeJS/8.4.0
Express
Vendor Status
[21.04.2024] Vulnerability discovered.
[22.04.2024] Vendor contacted.
[22.04.2024] Vendor responds.
[02.05.2024] Working with the vendor.
[20.01.2025] Vendor releases version 9.3.5 to address this issue.
[07.02.2025] Coordinated public security advisory released.
PoC
ws.sh
Credits
Vulnerability discovered by Gjoko Krstic - <[email protected]>
References
[1] https://search.abb.com/library/Download.aspx?DocumentID=9AKK108470A5684&LanguageCode=en&DocumentPartId=PDF&Action=Launch
[2] https://www.cve.org/CVERecord?id=CVE-2024-48849
Changelog
[07.02.2025] - Initial release
Contact
Zero Science Lab
Web: https://www.zeroscience.mk
e-mail: [email protected]