OTPulse

dynovaPRO™ Reset Credentials Vulnerability

Plan PatchCVSS 9.14jde002044Sep 17, 2026
ABBMitsubishi Electric
Attack path
Attack VectorNetwork
Auth RequiredNone
ComplexityLow
User InteractionNone needed
Summary

A vulnerability in the Keycloak authentication component integrated into dynovaPRO™ cloud system allows unauthenticated attackers to bypass authentication and hijack user accounts through the 'Forgot Password' functionality. An attacker can exploit this to take remote control of the product. ABB has deployed an update to the cloud system as of 2026-08-27 that resolves this vulnerability.

What this means
What could happen
An attacker could hijack dynovaPRO™ user accounts and gain remote control of the system, potentially allowing unauthorized modification of industrial processes or operational parameters depending on the compromised user's privileges.
Who's at risk
Any organization using dynovaPRO™ cloud system (all versions prior to 2026-08-27 update) is affected. This includes ABB and Mitsubishi Electric customers operating dynovaPRO™ for industrial process management. Particularly critical for water treatment facilities, electric utilities, and other critical infrastructure using this system for operational control.
How it could be exploited
An attacker sends a password reset request for a target user account without authentication or authorization. The vulnerable 'Forgot Password' functionality processes this request and issues a password reset token. The attacker uses this token to reset the user's password and gain account access, potentially with administrative privileges if the targeted user has them.
Prerequisites
  • Network access to dynovaPRO™ cloud system
  • Knowledge of valid user email addresses associated with dynovaPRO™ accounts
  • No credentials required to exploit the password reset functionality
Remotely exploitableNo authentication requiredLow complexity attackAffects cloud-based control system accessHigh CVSS score (9.1)
Exploitability
Some exploitation risk — EPSS score 6.4%
Public Proof-of-Concept (PoC) on GitHub (10 repositories)
Affected products (1)
ProductAffected VersionsFix Status
dynovaPRO™ cloud system < 2026-08-27 12:00 (CEST)All versionsFix available
Remediation & Mitigation
0/6
Do now
0/3
HOTFIXUpdate dynovaPRO™ cloud system to the version deployed on or after 2026-08-27 12:00 CEST
WORKAROUNDIf you received a password reset email that you did not request, reset your password immediately to ensure an attacker did not hijack your account
HARDENINGAudit all user accounts and access logs for unauthorized account modifications or unusual login activity since before the patch date
Schedule — requires maintenance window
0/2

Patching may require device reboot — plan for process interruption

WORKAROUNDIf password reset functionality remains disabled on your instance, re-enable it after confirming the cloud system has been updated to the patched version
HARDENINGRequire all dynovaPRO™ users to change their passwords after the system is patched
Long-term hardening
0/1
HARDENINGImplement network access controls to restrict dynovaPRO™ cloud system access to authorized IP ranges or require VPN connectivity
View full ABB PSIRT advisory
API: /api/v1/advisories/446409ff-912d-4f39-a1b9-abffb25eba1f

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.