CyberzSOC

Publication detail
← Back to advisories & guidance

ICSA-25-084-01: ABB RMC-100 ↗ source

March 25, 2025 CISA ICS Advisory
Source: https://www.cisa.gov/news-events/ics-advisories/icsa-25-084-01

Summary

An update is available that resolves a vulnerability in the product versions listed as affected in this advisory. An attacker who successfully exploited this vulnerability could cause the web UI to stop. CVE-2022-24999: A vulnerability exists in the web UI (REST interface) included in the product versions listed above. An attacker could exploit the vulnerability by sending a specially crafted message to the web UI node, causing a Node process hang, requiring restart of the REST interface (disable/enable).

Advisory Details CISA ICS CSAF feed

Advisory ID
ICSA-25-084-01
Status
Final · version 1.0.0
Initial release
2025-03-11
Last revised
2025-03-11
Vendor
ABB
Critical infrastructure sectors
Critical manufacturing
Deployed
Worldwide
Vendor headquarters
Switzerland

Republished vendor advisory. This CISA CSAF advisory was converted from ABB PSIRT's CSAF advisory.

Workarounds: The vulnerability is only present when the REST interface is enabled. Only enable the REST interface when needed for the configuration of MQTT. Ensure that the REST interface is disabled after finishing configuring MQTT utilities.

Mitigating factors: ABB recommends disabling the REST interface when not being used to configure the MQTT functionality. By default, the REST interface is disabled so no risk is present. The RMC-100 is not intended for access over public networks such as the internet. An attacker would need to have access to the customer’s private control network to exploit this vulnerability. Proper network segmentation is recommended. Refer to section “General security recommendations” for further advise on how to keep your system secure.

Credit: ABB PSIRT

Affected products (2)
  • RMC-100 — >=2105457-036|<2105457-044, 2105452-048
  • RMC-100 LITE — >=2106229-010|<2106229-016, 2106260-017

From CISA's machine-readable CSAF 2.0 advisory (JSON).

Vulnerabilities as Stated by the Advisory

CVEWeaknessCVSS v3Details
CVE-2022-24999 CWE-1321 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') 7.5 High CVE-2022-24999
A vulnerability exists in the web UI (REST interface) included in the product versions listed above. An attacker could exploit the vulnerability by sending a specially crafted message to the web UI node, causing a Node process hang, requiring restart of the REST interface (disable/enable).

Vendor fix: The problem is corrected in the following product versions: RMC-100 Customer Package (2105452-048). RMC-100 LITE Customer Package (2106260-017). ABB recommends that customers apply the update at earliest convenience. Please find these updates here: RMC - Flow… ↗

Affected, fixed & timeline

Affected:

  • RMC-100 >=2105457-036|<2105457-044
  • RMC-100 LITE >=2106229-010|<2106229-016

Fixed in:

  • RMC-100 2105452-048
  • RMC-100 LITE 2106260-017

Scores and weakness types are as CISA or the republishing vendor stated them in this advisory; the linked CVE pages carry the independently enriched CVSS and SSVC assessments.

News Coverage

No coverage found in monitored research blogs or news feeds.

CVEs Referenced in This Publication

CVECVSSAffected
CVE-2022-24999 7.5 High n/a n/a qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application becau…

Named by the advisory itself. Each CVE links to its tracked detail page.

Vendors Named in This Publication

No KEV-catalogued vendors are named in this publication.