Executive brief
ABB Automation Builder Gateway, a tool used to program and manage industrial controllers (PLCs), contains a security flaw where it is accessible over the network by default. This allows unauthorized individuals to remotely scan for and identify industrial controllers on the network. While built-in controller security may prevent direct control, this exposure provides attackers with critical information about the industrial environment that could be used for further attacks.
Technical details
The ABB Automation Builder Gateway for Windows (versions prior to 2.9.0) is affected by CWE-1188 (Initialization of a Resource with an Insecure Default). By default, the gateway service listens on all available network interfaces on TCP port 1217, rather than restricting access to the local host. An unauthenticated remote attacker can connect to this port to perform network scanning and identify AC500 PLCs within the environment. While the PLC's own user management may prevent unauthorized command execution, the gateway's default exposure facilitates reconnaissance of restricted industrial networks. The vulnerability is resolved in version 2.9.0 by changing the default listening address to 127.0.0.1.
Affected products
- ABB Automation Builder Gateway for Windows < 2.9.0
Timeline
- 2026-05-12: advisory: CISA Advisory ICSA-26-132-04 published
- 2026-05-12: patched: Fixed in Automation Builder 2.9.0