EUVD-2025-208631CVSS VectorNVD
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
5DescriptionNVD
Authentication bypass by capture-replay vulnerability in ABB AWIN GW100 rev.2, ABB AWIN GW120.This issue affects AWIN GW100 rev.2: 2.0-0, 2.0-1; AWIN GW120: 1.2-0, 1.2-1.
AnalysisAI
CVE-2025-13777 is an authentication bypass vulnerability in ABB AWIN Gateway devices (GW100 rev.2 and GW120) that allows attackers on adjacent networks to capture and replay authentication credentials without requiring privileges or user interaction. With a CVSS score of 8.3 and no evidence of active exploitation (not in KEV), this vulnerability enables attackers to gain unauthorized access and potentially compromise system confidentiality, integrity, and availability.
Technical ContextAI
The vulnerability affects ABB AWIN industrial gateway devices - specifically AWIN GW100 rev.2 (versions 2.0-0, 2.0-1) and AWIN GW120 (versions 1.2-0, 1.2-1) as identified by CPE strings cpe:2.3:a:abb:awin_gw100_rev.2:*:*:*:*:*:*:*:* and cpe:2.3:a:abb:awin_gw120:*:*:*:*:*:*:*:*. The root cause is CWE-294 (Authentication Bypass by Capture-Replay), where the authentication mechanism fails to protect against replay attacks, allowing captured authentication tokens or credentials to be reused by attackers to gain unauthorized access.
RemediationAI
ABB has published an official security advisory available at https://search.abb.com/library/Download.aspx?DocumentID=4JNO000329&LanguageCode=en&DocumentPartId=&Action=Launch. Users should review this advisory for specific patch information and update procedures. As a temporary mitigation, organizations should ensure these gateways are isolated from untrusted adjacent networks and implement network segmentation to limit potential attacker access to the same network segment as these devices.
Share
External POC / Exploit Code
Leaving vuln.today