ABB Cylon FLXeon Vulnerability: When Smart Buildings Get Hacked (And Not in a Cool Way)
The ABB Cylon FLXeon controller is dealing with a case of bad timing—literally. Its timeConfig.js script is so vulnerable that even a slightly mischievous hacker with login details can pull off authenticated remote code execution. It’s like giving a cat the house keys and wondering why your curtains are shredded.
Hot Take:
Who knew that time travel could be achieved with a little bit of code and a lot of vulnerability? The ABB Cylon FLXeon controllers have taken us back to a time when remote code execution was just a twinkle in a hacker’s eye. Kudos to ABB for making sure nostalgia isn’t left out of their smart building automation!
Key Points:
- ABB Cylon FLXeon controllers are vulnerable to authenticated remote code execution.
- The vulnerability exists in the /api/timeConfig endpoint due to improper input validation.
- Authenticated attackers can inject arbitrary commands by manipulating time-related parameters.
- The issue affects firmware versions up to 9.3.4 across several ABB controller series.
- Discovered by security researcher Gjoko ‘LiquidWorm’ Krstic with an advisory ID of ZSL-2025-5910.
Already a member? Log in here