Freelance Missing Length Check
MonitorCVSS 7.57paa010706Sep 18, 2026
ABB
Attack path
Attack VectorNetwork
Auth RequiredNone
ComplexityLow
User InteractionNone needed
Summary
A missing length validation check in ABB Freelance Controller DCP, AC700, AC800, and AC900 allows an attacker to send a malformed network message that causes the controller to stop responding or become inaccessible. The vulnerability affects Freelance versions through 2013, 2013 SP1, 2016, and earlier. Vendors have released patches for affected product versions under maintenance.
What this means
What could happen
An attacker could send a specially crafted network message that crashes the Freelance controller, causing loss of control over your process equipment and operational downtime.
Who's at risk
Operators and maintainers of ABB Freelance control systems, particularly those running DCP, AC700, AC800, or AC900 controllers in versions through 2016 and earlier. Affects any industrial automation environment using Freelance platforms—including power generation, water treatment, manufacturing, and chemical processing facilities.
How it could be exploited
An attacker on the network sends a message with an invalid length field to the controller. The controller fails to validate the message length, processes it incorrectly, and stops responding or becomes inaccessible, denying service to operators and control systems.
Prerequisites
- Network access to the Freelance controller on its service port
- No authentication required to send network messages to the controller
remotely exploitableno authentication requiredlow complexityaffects availability and process controlhigh CVSS score (7.5)
Exploitability
Unlikely to be exploited — EPSS score 0.3%
Affected products (4)
4 with fix
ProductAffected VersionsFix Status
Freelance Controller DCP≤ Freelance 2013Freelance 2013 SP1Freelance 2016 and 3 moreFix available
Freelance Controller AC700≤ Freelance 2013Freelance 2013 SP1Freelance 2016 and 3 moreFix available
Freelance Controller AC800≤ Freelance 2013Freelance 2013 SP1Freelance 2016 and 3 moreFix available
Freelance Controller AC900≤ Freelance 2013Freelance 2013 SP1Freelance 2016 and 3 moreFix available
Remediation & Mitigation
0/6
Do now
0/3WORKAROUNDEnable Download-Protection on AC 700 controllers by following the M&I AC 700F Controller user manual section 8.3.2 to lock the controller for application and firmware downloads
WORKAROUNDDisable Download function on AC 900 controllers using the Display Unit (Service menu, F2 Security, F2 function) as described in the controller user manual
HARDENINGRestrict network access to Freelance controllers to only authorized engineering and operations networks
Schedule — requires maintenance window
0/3Patching may require device reboot — plan for process interruption
HOTFIXUpdate Freelance 2013 SP1 systems to RU06 or higher
HOTFIXUpdate Freelance 2016 SP1 systems to RU07 or higher
HOTFIXUpdate Freelance 2019 SP1 systems to RU03 or higher
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/2d49b91e-9b4d-4a60-8257-8255f9c4f279Get OTPulse briefings by email
Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.