CVE-2024-4009

highpriority · track · 31OT risk · elevatedEPSS 0.001 · 4 %ileEURUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.14% (4th) EPSS

CVSS 7.8 · high

Is it mine?

22 products

Check your exposure

Who says so?

4 sources

cnnvd · enisa_euvd · fstec_bdu · nvd

EPSS · scored 2026-10-27

Replay Attack in ABB, Busch-Jaeger, FTS Display (version 1.00) and BCU (version 1.3.0.33) allows attacker to capture/replay KNX telegram to local KNX Bus-System

cvss

Technical severity, 0–10. One row per scoring source.

9.2

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–critical · 4.3–9.2

v3.17.8highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 1.8 · impact 5.9

v3.19.2criticalAV:L/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.19.2criticalCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:Hsecondary · cybersecurity@ch.abb.comexploitability 2.5 · impact 6

v4.07.3highCVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:H/SC:L/SI:H/SA:H/S:N/AU:N/V:D/RE:M/U:Greensecondary · ENISA EU

v4.07.3highCVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:H/SC:L/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:X/V:D/RE:M/U:Greensecondary · cybersecurity@ch.abb.com

v4.04.3mediumCVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:H/SC:L/SI:H/SA:H/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:X/V:D/RE:M/U:Greensecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Trackcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-294USprimaryCWE-294US

affected products (22)

Products and version ranges known to be affected.

ABB, Busch-Jaeger 2,4'' Display 70, SD-U12-70-1-4015≤ 1.00enisa_euvdEU
ABB, Busch-Jaeger 2,4'' Display 70, SD/U12.70.11-4015≤ 1.00enisa_euvdEU
ABB, Busch-Jaeger 2.4! Display 55, SD/SD/U12.55.1-825≤ 1.00enisa_euvdEU
ABB, Busch-Jaeger 2.4! Display 55, SD/U12.55.11-825≤ 1.00enisa_euvdEU
ABB, Busch-Jaeger 2.4! Display 63, SD/U12.63.11-825≤ 1.00enisa_euvdEU
ABB, Busch-Jaeger BCU KNX, BA-U1.0.1≤ 1.3.0.33enisa_euvdEU
ABB, Busch-Jaeger BCU KNX, BA-U1.0.11≤ 1.3.0.33enisa_euvdEU
ABB, Busch-Jaeger BCU KNX, BA-U1.0.21≤ 1.3.0.33enisa_euvdEU
ABB, Busch-Jaeger RoomTouch 4", RT-U12-86-1-811≤ 1.00enisa_euvdEU
ABB, Busch-Jaeger RoomTouch 4", RT/U12.86.1-825≤ 1.00enisa_euvdEU
ABB, Busch-Jaeger RoomTouch 4", RT/U12.86.11-811≤ 1.00enisa_euvdEU
ABB, Busch-Jaeger RoomTouch 4", RT/U12.86.11-825≤ 1.00enisa_euvdEU
ABB ABB Display 55≤ 1.02fstec_bduRU
ABB ABB Display 63≤ 1.02fstec_bduRU
ABB ABB Display 70≤ 1.02fstec_bduRU
ABB BCU KNX≤ 1.3.1_63fstec_bduRU
ABB RoomTouch 4≤ 1.02fstec_bduRU
abb 2tma310010b0001 firmware< 1.02nvdUScpe:2.3:o:abb:2tma310010b0001_firmware:*:*:*:*:*:*:*:*
abb 2tma310010b0003 firmware< 1.02nvdUScpe:2.3:o:abb:2tma310010b0003_firmware:*:*:*:*:*:*:*:*
abb 2tma310011b0001 firmware< 1.02nvdUScpe:2.3:o:abb:2tma310011b0001_firmware:*:*:*:*:*:*:*:*

showing 20 of 22

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu nvd NVD CVE.org MITRE

published 2024-06-05modified 2026-06-17

related (341)

Related entries.

ID	severity	EPSS	exploitable	published
CVE-2024-27348US	critical9.8OT critical	99.2% (100th)	KEV	2024-04-22
RCE-Remote Command Execution vulnerability in Apache HugeGraph-Server.This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.3.0 in Java8 & Java11 Users are recommended t…
CVE-2023-23397US	critical9.8OT critical	97.2% (100th)	KEV	2023-03-14
Microsoft Outlook Elevation of Privilege Vulnerability
CVE-2017-3191US	critical9.8OT high	62.5% (99th)	—	2017-12-16
D-Link DIR-130 firmware version 1.23 and DIR-330 firmware version 1.12 are vulnerable to authentication bypass of the remote login page. A remote attacker that can access the remot…
CVE-2024-3596US	critical9.0OT high	14.9% (97th)	Exploit	2024-07-09
RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response (Access-Accept, Access-Reject, or Access-Challenge) to any ot…
CVE-2017-6823US	high8.8OT high	8.04% (95th)	Exploit	2017-03-12
Fiyo CMS 2.0.6.1 allows remote authenticated users to gain privileges via a modified level parameter to dapur/ in an app=user&act=edit action.

+336 more

references (4)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan