CVE-2021-22277: AC 800M MMS - Denial of Service vulnerability in MMS communication

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-04-01 · updated 2026-06-17
Weakness: CWE-20

Description

Improper Input Validation vulnerability in ABB 800xA, Control Software for AC 800M, Control Builder Safe, Compact Product Suite - Control and I/O, ABB Base Software for SoftControl allows an attacker to cause the denial of service.

Affected products

ABB 800xA for MOD300: from 5.1.0-0 through 5.1.0-3; from 5.1.1-0 through 5.1.1-4; from 6.0.0-0 before 6.0.0-4; from 6.1.0-0 before 6.1.1-2 — fixed in 6.0.0-4, 6.1.1-2
ABB Base Software for SoftControl: from 5.1.0-0 through 5.1.0-3; from 5.1.1-0 through 5.1.1-4; from 6.0.0-0 through 6.0.0-3; from 6.1.0-0 through 6.1.1-1
ABB Compact Product Suite: from 5.1.0-0 through 5.1.0-3; from 5.1.1-0 through 5.1.1-4; from 6.0.0-0 through 6.0.0-3; from 6.1.0-0 through 6.1.1-1
ABB Control Builder Safe: before 3.0 — fixed in 3.0

How to fix

Upgrade to a fixed version: ABB 800xA for MOD300 6.0.0-4, 6.1.1-2; ABB Control Builder Safe 3.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-22277 or the next vulnerability affects your stack