EUVD-2025-208631CVSS Vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H
Lifecycle Timeline
3Description
Authentication bypass by capture-replay vulnerability in ABB AWIN GW100 rev.2, ABB AWIN GW120.This issue affects AWIN GW100 rev.2: 2.0-0, 2.0-1; AWIN GW120: 1.2-0, 1.2-1.
Analysis
CVE-2025-13777 is an authentication bypass vulnerability in ABB AWIN Gateway devices (GW100 rev.2 and GW120) that allows attackers on adjacent networks to capture and replay authentication credentials without requiring privileges or user interaction. With a CVSS score of 8.3 and no evidence of active exploitation (not in KEV), this vulnerability enables attackers to gain unauthorized access and potentially compromise system confidentiality, integrity, and availability.
Technical Context
The vulnerability affects ABB AWIN industrial gateway devices - specifically AWIN GW100 rev.2 (versions 2.0-0, 2.0-1) and AWIN GW120 (versions 1.2-0, 1.2-1) as identified by CPE strings cpe:2.3:a:abb:awin_gw100_rev.2:*:*:*:*:*:*:*:* and cpe:2.3:a:abb:awin_gw120:*:*:*:*:*:*:*:*. The root cause is CWE-294 (Authentication Bypass by Capture-Replay), where the authentication mechanism fails to protect against replay attacks, allowing captured authentication tokens or credentials to be reused by attackers to gain unauthorized access.
Affected Products
ABB AWIN GW100 rev.2: versions 2.0-0 and 2.0-1; ABB AWIN GW120: versions 1.2-0 and 1.2-1. These are industrial gateway devices used in automation and control systems. The vulnerability was reported directly by ABB and is tracked as ENISA EUVD-2025-208631.
Remediation
ABB has published an official security advisory available at https://search.abb.com/library/Download.aspx?DocumentID=4JNO000329&LanguageCode=en&DocumentPartId=&Action=Launch. Users should review this advisory for specific patch information and update procedures. As a temporary mitigation, organizations should ensure these gateways are isolated from untrusted adjacent networks and implement network segmentation to limit potential attacker access to the same network segment as these devices.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today