The ABB Cylon FLXeon BACnet controller is vulnerable to an unauthenticated WebSocket implementation that allows an attacker to execute the tcpdump command. By exploiting this vulnerability, an attacker can launch multiple instances of tcpdump, leading to resource exhaustion, denial of service (DoS) conditions, and potential data exfiltration. The lack of authentication on the WebSocket interface enables unauthorized users to continuously spawn new tcpdump processes, escalating the impact of the attack.
The ABB Cylon FLXeon BACnet controller is vulnerable to authenticated remote root code execution via the /api/users/password endpoint. An attacker with valid credentials can inject arbitrary system commands by manipulating the newPassword PUT parameter. This vulnerability allows for out-of-band (blind) command injection due to improper hashing and escaping of the new password in the users.js file, which is then passed to ChildProcess.exec() within a usermod command.
Services By CQR