CVE-2022-0902: ABB Flow Computer and Remote Controllers Path Traversal Vulnerability in Totalflow TCP protocol can lead to root access

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 16.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-07-21 · updated 2026-06-17
Weakness: CWE-22

Description

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in flow computer and remote controller products of ABB ( RMC-100 (Standard), RMC-100-LITE, XIO, XFCG5 , XRCG5 , uFLOG5 , UDC) allows an attacker who successfully exploited this vulnerability could insert and run arbitrary code in an affected system node.

Affected products

ABB Rmc-100-Lite Firmware: before 2106229-011 — fixed in 2106229-011
ABB Rmc-100 Firmware: before 2105457-037 — fixed in 2105457-037
ABB Udc Firmware: before 2106177-007 — fixed in 2106177-007
ABB Uflog5 Firmware: before 2105298-024 — fixed in 2105298-024
ABB Xfcg5 Firmware: before 2105805-016 — fixed in 2105805-016
ABB Xio Firmware: before 2106198-008 — fixed in 2106198-008
ABB Xrcg5 Firmware: before 2105864-016 — fixed in 2105864-016

How to fix

Upgrade to a fixed version: ABB Rmc-100-Lite Firmware 2106229-011; ABB Rmc-100 Firmware 2105457-037; ABB Udc Firmware 2106177-007; ABB Uflog5 Firmware 2105298-024; ABB Xfcg5 Firmware 2105805-016; ABB Xio Firmware 2106198-008; ABB Xrcg5 Firmware 2105864-016. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-0902 or the next vulnerability affects your stack