Is CVE-2025-13778 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-13778 being exploited in the wild.

How severe is CVE-2025-13778?

High severity, with a CVSS score of 8.3, published 13 March 2026.

Which products and versions are affected?

ABB AWIN GW100 rev.2 2.0-0, 2.0-1; ABB AWIN GW120 1.2-0, 1.2-1.

Is there a fix for CVE-2025-13778?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2025-13778 attacked?

It is attacked from the adjacent network, in a network appliance.

Am I affected by CVE-2025-13778?

Check whether you run ABB AWIN GW100 rev.2 or ABB AWIN GW120 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-13778: ABB AWIN GW100 and GW120 authentication bypass via capture-replay

CVE-2025-13778 · Severity: high · CVSS 8.3 · Published 2026-03-13

ABB AWIN gateways, which are used to connect industrial wireless sensor networks to plant-level systems, are vulnerable to an authentication bypass. An attacker with access to the local network could capture legitimate communication and replay it to gain unauthorized access to the device. This could allow an attacker to disrupt industrial monitoring operations or access sensitive operational data.

Technologies: ABB AWIN GW100 rev.2, ABB AWIN GW120. Vendors: ABB.

Quick answers

Is CVE-2025-13778 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-13778 being exploited in the wild.
How severe is CVE-2025-13778?: High severity, with a CVSS score of 8.3, published 13 March 2026.
Which products and versions are affected?: ABB AWIN GW100 rev.2 2.0-0, 2.0-1; ABB AWIN GW120 1.2-0, 1.2-1.
Is there a fix for CVE-2025-13778?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-13778 attacked?: It is attacked from the adjacent network, in a network appliance.
Am I affected by CVE-2025-13778?: Check whether you run ABB AWIN GW100 rev.2 or ABB AWIN GW120 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A capture-replay vulnerability (CWE-294) exists in the authentication mechanism of ABB AWIN GW100 rev.2 and GW120 gateways. The flaw allows an attacker on the adjacent network to intercept valid authentication traffic and replay it to the device to bypass security controls without knowing the actual credentials. Successful exploitation grants the attacker unauthorized access to the gateway's management or data functions. The vulnerability is confirmed in AWIN GW100 rev.2 versions 2.0-0 and 2.0-1, and AWIN GW120 versions 1.2-0 and 1.2-1. Users are advised to consult ABB advisory 4JNO000329 for remediation steps.

Affected products

ABB AWIN GW100 rev.2 2.0-0, 2.0-1
ABB AWIN GW120 1.2-0, 1.2-1

Identifiers

CVE-2025-13778
CVE-2025-13777
CVE-2025-13779

Timeline

2026-03-13: disclosed: Initial disclosure by ABB
2026-03-13: advisory: NVD publication date

References

https://search.abb.com/library/Download.aspx?DocumentID=4JNO000329&LanguageCode=en&DocumentPartId=&Action=Launch

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.