Multiple ABB ICS Vulnerabilities Enable Remote Code Execution

Affected Environment
ABB industrial and ICS-connected products, including System 800xA, Symphony Plus, PCM600, Edgenius, OPTIMAX, AWIN and S+ Engineering. Impacted sites are those deploying listed firmware and software versions in operational and engineering environments.

Threat Overview
Vulnerabilities span code execution, authentication bypass, denial of service and configuration disclosure in ABB control and gateway products. Exploitation can enable loss of control, unauthorized changes, device reboots and full engineering system compromise if network access is gained.

Exposure Timeline
Issues are disclosed with fixes available now or scheduled: some patches released in 2024–2026, others planned through 2027. Organizations remain exposed until affected versions are upgraded or mitigations and workarounds from ABB are implemented.

Attack Surface
Exposure arises on IEC 61850 networks, OPTIMAX with Azure AD SSO, Edgenius portals, AWIN gateway interfaces and S+ Client Server networks. Unsegmented or externally reachable ICS, management portals, or poorly controlled access to engineering networks increase risk.

Technical Root Cause
Root causes include flaws in IEC 61850 command handling, SharpZip library, Edgenius auth logic, OPTIMAX auth algorithm and AWIN session handling. Further exposure comes from PostgreSQL 13.11 and earlier vulnerabilities embedded in Symphony Plus Engineering installations.

Exploitation Pathway
An attacker sends specially crafted messages or queries to vulnerable nodes to bypass auth, reboot devices or execute arbitrary code. Where PostgreSQL is exposed on the S+ network, authenticated abuse of database functions can escalate to full system compromise.