CVE-2024-41975
mediumpriority · track · 0OT risk · elevatedEPSS 0.004 · 39 %ileCHDEEUUSEPSS · scored 2026-10-27
An unauthenticated remote attacker can gain limited information of the PLC network but the user management of the PLCs prevents the actual access to the PLCs.
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
A vendor fix is available.
- FixedAutomation Builderabb_psirt
If remote access is not required, check the "LocalAddress" setting in the [CmpGwCommDrvTcp] section of the Gateway's configuration file as follows (restart of gateway required in case of changes): [CmpGwCommDrvTcp] LocalAddress=127.0.0.1 ; allow access only from the local computer The gateway configuration file can be located at (example for Automation Builder 2.8): %ProgramFiles%\ABB\AB2.8\AutomationBuilder\GatewayPLC\Gateway.cfg Starting with Automation Builder version 2.9.0 the vulnerability is closed by setting the default for the gateway to local access. Automation Builder 2.9.0 is available for download from the related download site. https://www.abb.com/global/en/areas/motion/digital-tools/automation-builder/software-download
- Fixedcodesys_psirt
Update the following products to version 3.5.21.0. • CODESYS Edge Gateway for Windows • CODESYS Gateway for Windows Please note that a new version of the CODESYS (Edge) Gateway for Windows can be installed either with the corresponding standalone setup or as part of the setups of the following other CODESYS products: • CODESYS Development System V3 • CODESYS Control Win (SL) • CODESYS HMI • CODESYS OPC DA Server SL To ensure that all firewall rules are reset, we recommend uninstalling the previously mentioned setups that installed an affected Gateway. Compatibility notes: By default, all 3.5.21.0 setups that install a CODESYS (Edge) Gateway configure the CODESYS Gateway to only allow local client access and do not add a Microsoft Windows firewall rule for CODESYS Gateways V3 and V2.3. However, if remote access is required, you can follow the custom steps in the setup and select the 'Allow remote access' checkbox. In addition, remote access can be enabled for specific IP addresses by changing the 'LocalAddress' setting in the [CmpGwCommDrvTcp] section in the Gateway.cfg file: [CmpGwCommDrvTcp] LocalAddress=127.0.0.1 ; allow access only from the local computer ;LocalAddress=192.168.1.1 ; IP address (of any adapter) to be listened to - access is only allowed via this address ;LocalAddress=0.0.0.0 ; allow access from any remote machine The CODESYS Development System and the products available as CODESYS add-ons can be downloaded and installed directly with the CODESYS Installer or be downloaded from the CODESYS Store. Alternatively, as well as for all other products, you will find further information on obtaining the software update in the CODESYS Update area https://www.codesys.com/download.
- FixedAutomation Buildercisa_csaf_ot
If remote access is not required, check the "LocalAddress" setting in the [CmpGwCommDrvTcp] section of the Gateway's configuration file as follows (restart of gateway required in case of changes): [CmpGwCommDrvTcp] LocalAddress=127.0.0.1 ; allow access only from the local computer The gateway configuration file can be located at (example for Automation Builder 2.8): %ProgramFiles%\ABB\AB2.8\AutomationBuilder\GatewayPLC\Gateway.cfg Starting with Automation Builder version 2.9.0 the vulnerability is closed by setting the default for the gateway to local access. Automation Builder 2.9.0 is available for download from the related download site. https://www.abb.com/global/en/areas/motion/digital-tools/automation-builder/software-download
- Mitigationcodesys_psirt
There are two possibilities to mitigate the vulnerability in CODESYS (Edge) Gateways with versions before 3.5.21.0: 1. Check the "LocalAddress" setting in the [CmpGwCommDrvTcp] section of the Gateway's configuration file as follows: [CmpGwCommDrvTcp] LocalAddress=127.0.0.1 ; allow access only from the local computer ;LocalAddress=192.168.1.1 ; IP address (of any adapter) to be listened to - access is only allowed via this address ;LocalAddress=0.0.0.0 ; allow access from any remote machine 2. To reset the Microsoft Windows firewall rule, you must first uninstall the setup that was originally used to install the affected CODESYS Gateway. Beside the standalone Gateway setup, this can be one of the following setups: • CODESYS Development System V3 • CODESYS Control Win (SL) • CODESYS HMI • CODESYS OPC DA Server SL Afterward, perform the custom steps in the setup and ensure that the "CODESYS Gateway" is unchecked in the "Firewall Settings" screen.
- WorkaroundAutomation Builderabb_psirt
Workarounds are specific measures that a user can take to help block an attack, for example, temporarily disabling the vulnerable feature may remove the exposure with well-known impact on functionality. ABB has tested the following workarounds. Although these workarounds will not correct the underlying vulnerability, they can help block known attack vectors. When a workaround reduces functionality, this is identified below as “Impact of workaround”. The vulnerability can be closed by enabling local access only. See chapter “Recommended immediate actions” for details.
- WorkaroundAutomation Buildercisa_csaf_ot
Workarounds are specific measures that a user can take to help block an attack, for example, temporarily disabling the vulnerable feature may remove the exposure with well-known impact on functionality. ABB has tested the following workarounds. Although these workarounds will not correct the underlying vulnerability, they can help block known attack vectors. When a workaround reduces functionality, this is identified below as “Impact of workaround”. The vulnerability can be closed by enabling local access only. See chapter “Recommended immediate actions” for details.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (14)
Products and version ranges known to be affected.
advisories (4)
Vendor and ecosystem advisories describing this.
- 3ADR011525ABB Automation Builder Gateway for Windows with insecure defaults2026-02-24csaf · abb_psirtCH
ABB became aware of severe vulnerability in the products versions listed as affected in the advisory. The Windows gateway is accessible remotely by default. Unauthenticated attackers can therefore search for PLCs, but the user management of the PLCs prevents the actual access to the PLCs – unless it is disabled
- Advisory2025-02_VDE-2025-013CODESYS (Edge) Gateway for Windows insecure default2025-03-18csaf · codesys_psirtDE
The CODESYS Gateway enables communication between CODESYS runtimes and other clients, primarily the CODESYS Development System V3. It is usually installed as a part of the CODESYS Development System V3 setup and accessed locally by the CODESYS Development System. Due to an insecure standard configuration of the CODESYS Gateway, it is not only accessible locally, but also remotely by default.
- WID-SEC-W-2025-0583CODESYS Gateway: Schwachstelle ermöglicht Offenlegung von InformationenDeutsch2025-03-17csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in CODESYS Gateway ausnutzen, um Informationen offenzulegen.
- ICSA-26-132-04ABB Automation Builder Gateway for Windows2026-02-24icsa · cisa_csaf_otUS
ABB became aware of severe vulnerability in the products versions listed as affected in the advisory. The Windows gateway is accessible remotely by default. Unauthenticated attackers can therefore search for PLCs, but the user management of the PLCs prevents the actual access to the PLCs – unless it is disabled
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (5)
External citations — patches, advisories, analysis.
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan