EUVD-2025-208631Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Replay attack prevention
|
| Impact | The CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H) indicates this is an adjacent network attack with low complexity, requiring no privileges or user interaction, resulting in high confidentiality and availability impact but low integrity impact. While the 8.3 CVSS score suggests high severity, the adjacent network requirement (AV:A) significantly limits the attack surface compared to network-accessible vulnerabilities. With no KEV listing, no public POC mentioned, and no EPSS data available, this appears to be a theoretical risk rather than an actively exploited vulnerability. The authentication bypass tag and capture-replay nature suggest this could be automated once discovered, but the adjacent network requirement provides a meaningful barrier to widespread exploitation. |
| Exploit ScenarioDerived | An attacker with access to the same network segment as the AWIN gateway (such as through compromised IT/OT network segmentation or physical access to the industrial network) could passively capture authentication traffic between legitimate users and the gateway. The attacker could then replay these captured authentication credentials to gain unauthorized access to the gateway without needing valid credentials, potentially allowing them to disrupt operations, access sensitive data, or use the gateway as a pivot point for further attacks on the industrial control system. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 13, 2026
CVE-2025-13777 is an authentication bypass vulnerability in ABB AWIN Gateway devices (GW100 rev.2 and GW120) that allows attackers on adjacent networks to capture and replay authentication credentials without requiring privileges or user interaction. With a CVSS score of 8.3 and no evidence of active exploitation (not in KEV), this vulnerability enables attackers to gain unauthorized access and potentially compromise system confidentiality, integrity, and availability.
RemediationAI
ABB has published an official security advisory available at https://search.abb.com/library/Download.aspx?DocumentID=4JNO000329&LanguageCode=en&DocumentPartId=&Action=Launch. Users should review this advisory for specific patch information and update procedures. As a temporary mitigation, organizations should ensure these gateways are isolated from untrusted adjacent networks and implement network segmentation to limit potential attacker access to the same network segment as these devices.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability affects ABB AWIN industrial gateway devices - specifically AWIN GW100 rev.2 (versions 2.0-0, 2.0-1) and AWIN GW120 (versions 1.2-0, 1.2-1) as identified by CPE strings cpe:2.3:a:abb:awin_gw100_rev.2:*:*:*:*:*:*:*:* and cpe:2.3:a:abb:awin_gw120:*:*:*:*:*:*:*:*. The root cause is CWE-294 (Authentication Bypass by Capture-Replay), where the authentication mechanism fails to protect against replay attacks, allowing captured authentication tokens or credentials to be reused by attackers to gain unauthorized access.
Know when Abb gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:H/SC:N/SI:N/SA:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
Authentication bypass by capture-replay vulnerability in ABB AWIN GW100 rev.2, ABB AWIN GW120.This issue affects AWIN GW100 rev.2: 2.0-0, 2.0-1; AWIN GW120: 1.2-0, 1.2-1.
Executive ViewAI
ABB AWIN Gateway devices (GW100 rev.2 and GW120) are vulnerable to an authentication bypass that allows attackers on adjacent networks to steal and replay credentials without user interaction, potentially gaining unauthorized access to critical infrastructure. Organizations using these devices face immediate risk to operational technology systems, with no vendor patch currently available to remediate the threat.
Implement strict network segmentation to isolate AWIN Gateway devices from untrusted networks; restrict administrative access to a dedicated, hardened management network; deploy packet-level encryption or VPN tunnels for all traffic to/from affected devices; implement robust logging and real-time alerting on authentication events; consider disabling remote access capabilities if operationally feasible; monitor for credential replay patterns and implement rate-limiting on authentication endpoints.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Multiple stack-based buffer overflows in RobNetScanHost.exe in ABB Robot Communications Runtime before 5.14.02, as used
Unauthorized file access in WEB Server in ABB ASPECT - Enterprise v3.08.01; NEXUS Series v3.08.01 ; MATRIX Series v3.08.
Unauthorized file access in WEB Server in ABB ASPECT - Enterprise v3.08.01; NEXUS Series v3.08.01 ; MATRIX Series v3.08.
cgi-bin/write.cgi in Anti-Web through 3.8.7, as used on NetBiter / HMS, Ouman EH-net, Alliance System WS100 --> AWU 500,
The ABB HMI components implement hidden administrative accounts that are used during the provisioning phase of the HMI i
The ABB IDAL HTTP server CGI interface contains a URL that allows an unauthenticated attacker to bypass authentication a
The ABB IDAL HTTP server mishandles format strings in a username or cookie during the authentication process. Rated high
The ABB IDAL HTTP server is vulnerable to a buffer overflow when a long Host header is sent in a web request. Rated high
The ABB IDAL FTP server mishandles format strings in a username during the authentication process. Rated high severity (
Default credential in install package in ABB ASPECT; NEXUS Series; MATRIX Series version 3.07 allows attacker to login t
The ABB CP635 HMI uses two different transmission methods to upgrade its firmware and its software components: "Utilizat
Path traversal in ABB Mint Workbench I through version 5876 allows any local user to reach files outside the intended re
GitHub PoC
Exploit-DB