OTPulse

ABB Manufacturing Execution System- PHP Vulnerabilities in DokuWiki installations

Act NowCVSS 9.84hzk000017Oct 23, 2026
ABBManufacturing
Attack path
Attack VectorNetwork
Auth RequiredNone
ComplexityLow
User InteractionNone needed
Summary

ABB has identified critical PHP vulnerabilities affecting Dokuwiki installations in its Manufacturing Execution System products. These vulnerabilities in PHP versions below 8.2.35, 8.3.36, 8.4.27, and 8.5.12 allow unauthenticated remote code execution on the Dokuwiki server. The vulnerabilities are not tied to a specific MES version but to the PHP runtime environment used by Dokuwiki. Affected PHP versions must be updated immediately on the operating system hosting Dokuwiki.

What this means
What could happen
An attacker could execute arbitrary code on your Dokuwiki server without needing credentials, potentially gaining full control of the Manufacturing Execution System (MES) and any connected process data or operations it monitors.
Who's at risk
Manufacturing facilities using ABB Manufacturing Execution Systems (MES) that include Dokuwiki documentation or configuration interfaces. This affects any MES deployment where Dokuwiki runs on PHP versions earlier than 8.2.35, 8.3.36, 8.4.27, or 8.5.12, regardless of the specific MES version.
How it could be exploited
An attacker sends a crafted HTTP request to the Dokuwiki web interface exploiting a PHP vulnerability. The vulnerable PHP engine processes the request and executes attacker-supplied code on the server, giving the attacker command execution capabilities on the MES host.
Prerequisites
  • Network access to the Dokuwiki web server port (typically HTTP/HTTPS)
  • Dokuwiki deployed with a vulnerable PHP version (below 8.2.35, 8.3.36, 8.4.27, or 8.5.12)
remotely exploitableno authentication requiredlow complexityhigh EPSS score (11.6%)affects manufacturing operations and MES
Exploitability
Likely to be exploited — EPSS score 11.6%
Public Proof-of-Concept (PoC) on GitHub (10 repositories)
Affected products (1)
ProductAffected VersionsFix Status
DokuwikiAll versionsFix available
Remediation & Mitigation
0/4
Do now
0/4
HOTFIXUpdate PHP packages to version 8.5.12, 8.4.27, 8.3.36, or 8.2.35 on the operating system hosting Dokuwiki
HOTFIXVerify current PHP version by running 'php -v' on the server after updating
WORKAROUNDRestrict network access to the Dokuwiki web server to only authorized users and engineering workstations via firewall rules or network segmentation
WORKAROUNDIf patching cannot be completed immediately, temporarily shut down the Dokuwiki web server until PHP is updated
View full ABB PSIRT advisory
API: /api/v1/advisories/d8d44fae-23ee-4d57-8fd8-d8a572940f36

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.