Is CVE-2024-41975 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2024-41975 being exploited in the wild.

How severe is CVE-2024-41975?

High severity, with a CVSS score of 5.3, published 12 May 2026.

Which products and versions are affected?

ABB Automation Builder Gateway < 2.9.0.

Is there a fix for CVE-2024-41975?

A patch was published on 2026-05-12: Fixed in Automation Builder 2.9.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2024-41975 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2024-41975?

Check whether you run ABB Automation Builder Gateway at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-41975: ABB Automation Builder Gateway insecure default configuration

Q: Is there a fix for CVE-2024-41975?

A patch was published on 2026-05-12: Fixed in Automation Builder 2.9.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2024-41975 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2024-41975?

Check whether you run ABB Automation Builder Gateway at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-41975 · Severity: high · CVSS 5.3 · Published 2026-05-12

ABB Automation Builder Gateway, a tool used to program and manage industrial controllers (PLCs), contains a security flaw where it is accessible over the network by default. This allows unauthorized individuals to remotely scan for and identify industrial controllers on the network. While built-in controller security may prevent direct control, this exposure provides attackers with critical information about the industrial environment that could be used for further attacks.

Vendors: ABB.

Quick answers

Is CVE-2024-41975 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2024-41975 being exploited in the wild.
How severe is CVE-2024-41975?: High severity, with a CVSS score of 5.3, published 12 May 2026.
Which products and versions are affected?: ABB Automation Builder Gateway < 2.9.0.
Is there a fix for CVE-2024-41975?: A patch was published on 2026-05-12: Fixed in Automation Builder 2.9.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-41975 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2024-41975?: Check whether you run ABB Automation Builder Gateway at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The ABB Automation Builder Gateway for Windows (versions prior to 2.9.0) is affected by CWE-1188 (Initialization of a Resource with an Insecure Default). By default, the gateway service listens on all available network interfaces on TCP port 1217, rather than restricting access to the local host. An unauthenticated remote attacker can connect to this port to perform network scanning and identify AC500 PLCs within the environment. While the PLC's own user management may prevent unauthorized command execution, the gateway's default exposure facilitates reconnaissance of restricted industrial networks. The vulnerability is resolved in version 2.9.0 by changing the default listening address to 127.0.0.1.

Affected products

ABB Automation Builder Gateway for Windows < 2.9.0

Timeline

2026-05-12: advisory: CISA Advisory ICSA-26-132-04 published
2026-05-12: patched: Fixed in Automation Builder 2.9.0

References

https://www.cisa.gov/news-events/ics-advisories/icsa-26-132-04

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.