ABB Manufacturing Execution System- PHP Vulnerabilities in DokuWiki installations
ABB is aware of publicly reported vulnerabilities in the product listed as affected in the advisory. Updates to the affected component that fixed the vulnerabilities are available. An attacker who successfully exploited this vulnerability could remotely execute code on the server run-ning Dokuwiki. No active exploitations of the vulnerabilities have been reported by the time of writing this document
beschreibt (2)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-109619US | high8.1OT kritisch | KEV | ||
PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The g… | ||||
| CVE-2026-109618US | critical9.8OT kritisch | KEV | ||
PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
Behebungen (6)
- MitigationABB Manufacturing Execution System (MES) installed with Dokuwiki
Updating to a release containing the patches is the only complete and reliable mitigation. You should immediately update the PHP component in Dokuwiki to one of the following: 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP is installed on the web server / operating system, so upgrading PHP is a server administration task. • To check the version of PHP: use ‘php -v’ (as ‘root’). • The exact names and availability of individual PHP packages vary by distribution release. To see the list of installed PHP packages: dnf list installed 'php*'. o Typical package names on RHEL-family systems look like: - php - php-cli - php-common - php-gd - php-intl - php-mbstring - php-opcache - php-pdo - php-xml - (there might be other PHP packages, as well) Refer to section “General security recommendations” for further advise on how to keep your system secure.
- MitigationABB Manufacturing Execution System (MES) installed with Dokuwiki
Updating to a release containing the patches is the only complete and reliable mitigation. You should immediately update the PHP component in Dokuwiki to one of the following: 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP is installed on the web server / operating system, so upgrading PHP is a server administration task. • To check the version of PHP: use ‘php -v’ (as ‘root’). • The exact names and availability of individual PHP packages vary by distribution release. To see the list of installed PHP packages: dnf list installed 'php*'. o Typical package names on RHEL-family systems look like: - php - php-cli - php-common - php-gd - php-intl - php-mbstring - php-opcache - php-pdo - php-xml - (there might be other PHP packages, as well) Refer to section “General security recommendations” for further advise on how to keep your system secure.
- BehobenABB Manufacturing Execution System (MES) installed with Dokuwiki
The vulnerabilities are not tight to any specific MES version but solely depend on the delivery including Dokuwiki, which relies on affected PHP versions. The affected PHP versions are listed in CERT-EU - Critical Vulnerabilities in PHP Reference section. The problem is corrected in the following product versions: • PHP 8.5.12 • PHP 8.4.27 • PHP 8.3.36 • PHP 8.2.35 ABB recommends that customers apply the updates immediately. The updates are applied by updating the PHP packages in operating system of the servers that run Dokuwiki. PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution. All PHP users are strongly encouraged to update immediately. PHP is installed on the web server / operating system, so upgrading PHP is a server administration task. It needs to be checked which PHP packages are installed on the system, and upgrade them (depending on the OS, with either ‘dnf’ or ‘yum’). ABB recommends that only PHP packages are updated, not the whole Dokuwiki installation.
- BehobenABB Manufacturing Execution System (MES) installed with Dokuwiki
The vulnerabilities are not tight to any specific MES version but solely depend on the delivery including Dokuwiki, which relies on affected PHP versions. The affected PHP versions are listed in CERT-EU - Critical Vulnerabilities in PHP Reference section. The problem is corrected in the following product versions: • PHP 8.5.12 • PHP 8.4.27 • PHP 8.3.36 • PHP 8.2.35 ABB recommends that customers apply the updates immediately. The updates are applied by updating the PHP packages in operating system of the servers that run Dokuwiki. PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution. All PHP users are strongly encouraged to update immediately. PHP is installed on the web server / operating system, so upgrading PHP is a server administration task. It needs to be checked which PHP packages are installed on the system, and upgrade them (depending on the OS, with either ‘dnf’ or ‘yum’). ABB recommends that only PHP packages are updated, not the whole Dokuwiki installation.
- WorkaroundABB Manufacturing Execution System (MES) installed with Dokuwiki
The only workaround, while patches are not installed, is to temporarily shut down the Dokuwiki server(s).
- WorkaroundABB Manufacturing Execution System (MES) installed with Dokuwiki
The only workaround, while patches are not installed, is to temporarily shut down the Dokuwiki server(s).
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan