CoreSense™ HM and CoreSense™ M10 File Path Traversal Vulnerability

An attacker could read sensitive configuration files, credentials, or operational data stored on the device without authentication, potentially gaining the information needed to further compromise the system or plant network.

Water authorities and utilities using ABB CoreSense HM monitoring systems or CoreSense M10 devices for industrial process monitoring and control. Impact is highest for organizations with these devices exposed to untrusted network segments or where local access is not strictly controlled.

An attacker with local filesystem access (or via a web interface if exposed) can craft a path traversal request using directory traversal sequences (e.g., ../) to navigate outside intended directories and access restricted files containing configuration or credentials.