ABB Cylon’s Comedy of Errors: Input Validation Fiasco in Version 3.08.02!
The ABB Cylon Aspect is an award-winning solution for managing building energy with such flair that even your smart devices blush. However, its input validation is less than stellar, allowing sneaky attackers to poison the configuration. So, ensure your building’s energy isn’t managed by someone who thinks “99999999999999999999999” is a valid port number.
Hot Take:
When life gives you lemons, make a lemonade stand on port 9999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999. ABB’s webServerUpdate.php script has more holes than a block of Swiss cheese, allowing attackers to throw arbitrary port numbers like confetti at a parade. Who knew port numbers could be this fun?
Key Points:
- ABB’s ASPECT building management system is vulnerable due to improper input validation.
- The issue stems from server-side neglect, relying solely on client-side checks.
- Attackers can exploit this for configuration poisoning and DoS attacks.
- Cross-Site Request Forgery (CSRF) and authentication bypass are the cherries on top.
- The vulnerability was discovered by Gjoko “LiquidWorm” Krstic.
Already a member? Log in here