ABB Cylon FLXeon Firmware Fiasco: Remote Code Execution Vulnerability Strikes Again 🚨
Behold, the ABB Cylon FLXeon BACnet controller, a marvel of building automation! However, it turns out it’s also a secret agent for chaos, offering remote code execution to anyone with valid credentials. Just push the right buttons (or in this case, parameters), and voilĂ , you’ve got yourself a rogue building controller!
Hot Take:
Who knew changing passwords could be so dangerous? Apparently, ABB Cylon FLXeon controllers said, “Hold my beer,” and turned a simple password update into a hacker’s playground. If your HVAC system starts playing Mozart at 3 AM, you might want to blame the FLXeon for not escaping its password nightmares!
Key Points:
- ABB Cylon FLXeon controllers are vulnerable to remote code execution through password update manipulation.
- The vulnerability affects BACnet controllers used in smart building management.
- An attacker needs valid credentials to exploit the vulnerability.
- The flaw lies in improper handling of the newPassword PUT parameter.
- The issue was discovered by cybersecurity researcher Gjoko Krstic, aka ‘LiquidWorm’.
Already a member? Log in here