ABB Edgenius Management Portal
Plan PatchCVSS 9.6ICS-CERT ICSA-26-120-03Nov 20, 2025
ABB
Attack path
Attack VectorAdjacent
Auth RequiredNone
ComplexityLow
User InteractionNone needed
Summary
ABB identified a critical authentication bypass vulnerability in ABB Ability Edgenius versions 3.2.0.0 through 3.2.1.1. An unauthenticated attacker could exploit this to install arbitrary code, uninstall applications, or modify application configurations on systems running vulnerable versions. The vulnerability has not been observed in active exploitation. ABB has released version 3.2.2.0 as a fix.
What this means
What could happen
An attacker without any credentials could install malicious code, uninstall applications, or change application settings on your Edgenius management system, potentially compromising plant monitoring, data collection, and control integrations.
Who's at risk
Any organization running ABB Ability Edgenius versions 3.2.0.0 through 3.2.1.1 is affected. This includes water treatment facilities, power plants, and other industrial operations using Edgenius for equipment monitoring and application management.
How it could be exploited
An attacker on your network (no special tools needed) accesses the Edgenius Management Portal directly without logging in, then uses the unauthenticated interface to upload and execute code on the Edgenius server. This could be done from any machine with network access to the portal.
Prerequisites
- Network access to the Edgenius Management Portal (typically port 80/443 or custom port)
- No authentication required
Remotely exploitableNo authentication requiredLow complexityHigh CVSS score (9.6)Could affect critical infrastructure monitoring
Exploitability
Unlikely to be exploited — EPSS score 0.0%
Affected products (2)
2 with fix
ProductAffected VersionsFix Status
Ability Edgenius 3.2.0.03.2.0.03.2.2.0
Ability Edgenius 3.2.1.13.2.1.13.2.2.0
Remediation & Mitigation
0/3
Do now
0/2WORKAROUNDDisable the Edgenius Management Portal access if upgrade cannot be applied immediately
HARDENINGRestrict network access to the Edgenius Management Portal to trusted engineering workstations and admin systems only using firewall rules
Schedule — requires maintenance window
0/1Patching may require device reboot — plan for process interruption
HOTFIXUpgrade ABB Ability Edgenius to version 3.2.2.0 or later
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/be765235-9a9a-424c-bf28-3f5675ccc554Get OT security insights every Tuesday
Advisory breakdowns, a weekly summary, and incident analyses for the people actually defending OT environments. Free, no account required.