← Advisories

ABB Cylon FLXeon 9.3.4 (users.js) Authenticated Root Remote Code Execution

Critical
Advisory ID
ZSL-2025-5912
Release Date
04 February 2025
Vendor
Affected Version
FLXeon Series (FBXi Series, FBTi Series, FBVi Series), CBX Series (FLX Series), CBT Series, CBV Series, Firmware: <=9.3.4
Tested On
Linux Kernel 5.4.27, Linux Kernel 4.15.13, NodeJS/8.4.0, Express
Summary

BACnet® Smart Building Controllers. ABB's BACnet portfolio features a series of BACnet® IP and BACnet MS/TP field controllers for ASPECT® and INTEGRA™ building management solutions. ABB BACnet controllers are designed for intelligent control of HVAC equipment such as central plant, boilers, chillers, cooling towers, heat pump systems, air handling units (constant volume, variable air volume, and multi-zone), rooftop units, electrical systems such as lighting control, variable frequency drives and metering.

The FLXeon Controller Series uses BACnet/IP standards to deliver unprecedented connectivity and open integration for your building automation systems. It's scalable, and modular, allowing you to control a diverse range of HVAC functions.

Description

The ABB Cylon FLXeon BACnet controller is vulnerable to authenticated remote root code execution via the /api/users/password endpoint. An attacker with valid credentials can inject arbitrary system commands by manipulating the newPassword PUT parameter. The issue arises in users.js, where the new password is hashed and improperly escaped before being passed to ChildProcess.exec() within a usermod command, allowing out of band (blind) command injection.

Proof of Concept
Disclosure Timeline
21.04.2024Vulnerability discovered.
22.04.2024Vendor contacted.
22.04.2024Vendor responds.
02.05.2024Working with the vendor.
20.01.2025Vendor releases version 9.3.5 to address this issue.
04.02.2025Coordinated public security advisory released.
Credits
Vulnerability discovered by Gjoko Krstic
References
Changelog
04.02.2025Initial release
05.02.2025Added reference [3]
09.05.2025Added reference [4]