ABB M2M Gateway

Act NowCVSS 8.8ICS-CERT ICSA-25-105-08Apr 7, 2025

ABBEnergy

Attack path

Attack VectorNetwork

Auth RequiredLow

ComplexityLow

User InteractionNone needed

Summary

The ABB M2M Gateway ARM600 and SW contain multiple vulnerabilities in firmware and software versions 4.1.2 through 5.0.3. These vulnerabilities include integer overflow, improper input validation, use-after-free, path traversal, weak cryptography, insufficient authentication, and other flaws affecting integrity, confidentiality, and availability. Successful exploitation could allow an attacker to stop the product, make it inaccessible, take remote control, or execute arbitrary code.

What this means

What could happen

An attacker with network access and valid credentials could take remote control of the M2M Gateway, execute arbitrary commands, or cause it to crash, disrupting remote site connectivity and Supervisory Control and Data Acquisition (SCADA) communications across your enterprise network.

Who's at risk

This affects energy utilities and industrial operators who use ABB M2M Gateway devices (ARM600 or SW) for remote site management and SCADA communications. Organizations relying on these gateways to connect distributed field sites (substations, generation facilities, grid control nodes) to central monitoring and control systems are at risk. Any site using firmware/software versions 4.1.2 through 5.0.3 is vulnerable.

How it could be exploited

An attacker could exploit multiple vulnerabilities in the M2M Gateway's communication protocols and authentication mechanisms. With network access to exposed ports and valid user credentials, they could inject malicious commands or payloads through multiple pathways—including DNS spoofing, ICMP manipulation, or direct protocol exploitation—to gain code execution on the gateway device and pivot to control remote industrial sites.

Prerequisites

Network access to the M2M Gateway from the Internet or an adjacent untrusted network
Valid user credentials (non-default username and password)
Knowledge of exposed communication ports (TCP/UDP 53, VPN port, or management ports)

Remotely exploitableRequires valid user credentials but CVSS implies low attack complexityHigh EPSS score (92.5%) indicates high exploitation probabilityNo vendor patch planned—end-of-life productAffects critical communication infrastructure for OT networks

Exploitability

Likely to be exploited — EPSS score 92.8%

Metasploit module available — weaponized exploitView module ↗

Public Proof-of-Concept (PoC) on GitHub (10 repositories)

Affected products (2)

2 EOL

ProductAffected VersionsFix Status

M2M Gateway ARM600, firmware≥ 4.1.2|≤ 5.0.3No fix (EOL)

M2M Gateway SW, software≥ 5.0.1|≤ 5.0.3No fix (EOL)

Remediation & Mitigation

0/8

Do now

0/5

HARDENINGIf M2M Gateway must be Internet-accessible, restrict all inbound traffic to the VPN port only; disable or block all other ports and services

WORKAROUNDBlock TCP/UDP port 53 (DNS) at your firewall if DNS is not used by the M2M Gateway system

HARDENINGConfigure firewall allowlist rules to explicitly permit only required ports and protocols; block all other inbound and outbound traffic by default

WORKAROUNDFilter ICMP type 13 and 14 packets from external networks using firewall rules to prevent time service enumeration

HARDENINGChange all default user credentials on ARM600 and Arctic wireless gateways to complex, non-default, non-reusable passwords with special characters

Schedule — requires maintenance window

0/1

Patching may require device reboot — plan for process interruption

HARDENINGImplement continuous network monitoring and intrusion detection/prevention tools to detect anomalous traffic and commands targeting the M2M Gateway

Mitigations - no patch available

0/2

The following products have reached End of Life with no planned fix: M2M Gateway ARM600, firmware, M2M Gateway SW, software. Apply the following compensating controls:

HARDENINGImplement a private cellular access point (APN) and dedicated SIM subscriptions with your cellular provider to avoid exposing M2M Gateway traffic to the Internet

HARDENINGPlace M2M Gateway in a demilitarized zone (DMZ) segregated from your OT network by firewall; route all Internet-bound VPN traffic through the DMZ

CVEs (42)

View full CISA ICS-CERT advisory

↑↓ Navigate · Esc Close

API: /api/v1/advisories/b7ee78ab-dc3d-4ffd-92cd-9cd77e23aa6e

Get OT security insights every Tuesday

Advisory breakdowns, a weekly summary, and incident analyses for the people actually defending OT environments. Free, no account required.