# CVE-2021-22291: ABB EIBPORT cross-site scripting and session management flaws

Source: https://junglewise.ai/threats/cve-2021-22291-abb-eibport-cross-site-scripting-and-session-management-flaws  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-28. Updated: 2026-05-28  
License: CC BY 4.0 with a link back

CVE-2021-22291 · Severity: high · CVSS 8 · Published 2026-05-28

ABB EIBPORT is a building management system used to automate facilities based on the KNX standard. A vulnerability in its web interface could allow an attacker to gain unauthorized access to the device, potentially exposing sensitive building data or allowing them to change the device's configuration. This could lead to unauthorized control over building automation systems if the device is not properly isolated from untrusted networks.

Vendors: [ABB](https://junglewise.ai/threats/vendors/abb).

## Quick answers

**Is CVE-2021-22291 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2021-22291 being exploited in the wild.

**How severe is CVE-2021-22291?** High severity, with a CVSS score of 8, published 28 May 2026.

**Which products and versions are affected?** ABB EIBPORT V3 KNX (2CLA963710W1001) < 3.9.2; ABB EIBPORT V3 KNX (2CSM256242R2001) < 3.9.2; ABB EIBPORT V3 KNX GSM (2CLA963720W1001) < 3.9.2.

**Is there a fix for CVE-2021-22291?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2021-22291 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2021-22291?** Check whether you run ABB EIBPORT V3 KNX (2CLA963710W1001), ABB EIBPORT V3 KNX (2CSM256242R2001) or ABB EIBPORT V3 KNX GSM (2CLA963720W1001) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability (CVE-2021-22291) is classified as Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). The root cause is a failure in the firmware's session management to maintain secure identifiers, specifically allowing an attacker to obtain a copy of a session ID. While the attack vector is listed as network-based, the vendor notes that exploitation typically requires the device to be improperly exposed to untrusted networks or the internet. A successful exploit allows an attacker to bypass authentication, access sensitive information, and modify device configurations. ABB has released firmware version 3.9.2 to address these issues by hardening credential verification and session identifier handling.

## Affected products

- ABB EIBPORT V3 KNX (2CLA963710W1001) < 3.9.2
- ABB EIBPORT V3 KNX (2CSM256242R2001) < 3.9.2
- ABB EIBPORT V3 KNX GSM (2CLA963720W1001) < 3.9.2

## Timeline

- 2026-05-28: advisory: CISA Advisory ICSA-26-148-03 published.

## References

- [https://www.cisa.gov/news-events/ics-advisories/icsa-26-148-03](https://www.cisa.gov/news-events/ics-advisories/icsa-26-148-03)