The ABB Cylon FLXeon BACnet controller is vulnerable to an unauthenticated WebSocket implementation that allows an attacker to execute the tcpdump command. By exploiting this vulnerability, an attacker can launch multiple instances of tcpdump, leading to resource exhaustion, denial of service (DoS) conditions, and potential data exfiltration. The lack of authentication on the WebSocket interface enables unauthorized users to continuously spawn new tcpdump processes, escalating the impact of the attack.
A CSRF vulnerability is found in the ABB Cylon FLXeon series. Exploitation is restricted due to the server's CORS configuration, which lacks Access-Control-Allow-Credentials. The exploit conditions include hosting the malicious page on the same domain, Man-in-the-Middle attacks, LAN access, subdomain hosting, and misconfigured CORS policies.
An authenticated attacker can access critical information via the system logs page of ABB Cylon FLXeon controllers, including the OpenSSL password for stored certificates. This data exposure can lead to potential attacks like decrypting encrypted communications, impersonation, or gaining deeper system access.
The ABB Cylon FLXeon BACnet controller is vulnerable to authenticated remote root code execution via the /api/users/password endpoint. An attacker with valid credentials can inject arbitrary system commands by manipulating the newPassword PUT parameter. This vulnerability allows for out-of-band (blind) command injection due to improper hashing and escaping of the new password in the users.js file, which is then passed to ChildProcess.exec() within a usermod command.
The ABB Cylon FLXeon BACnet controller in versions <=9.3.4 uses weak default administrative credentials, which can be exploited in remote password attacks to gain unauthorized access and full control of the system.
Services By CQR