EUVD-2025-208635
CVSS Vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H
Lifecycle Timeline
3Description
Missing authentication for critical function vulnerability in ABB AWIN GW100 rev.2, ABB AWIN GW120.This issue affects AWIN GW100 rev.2: 2.0-0, 2.0-1; AWIN GW120: 1.2-0, 1.2-1.
Analysis
Missing authentication vulnerability in ABB AWIN industrial gateways (GW100 rev.2 and GW120) that allows attackers on adjacent networks to access critical functions without credentials. With a CVSS score of 8.3 and no EPSS data or KEV listing, this appears to be a newly disclosed vulnerability with no evidence of active exploitation or public POC availability.
Technical Context
The vulnerability affects ABB AWIN series industrial gateways - specifically GW100 rev.2 (versions 2.0-0, 2.0-1) and GW120 (versions 1.2-0, 1.2-1) as identified by CPE entries cpe:2.3:a:abb:awin_gw100_rev.2:*:*:*:*:*:*:*:* and cpe:2.3:a:abb:awin_gw120:*:*:*:*:*:*:*:*. These are industrial communication gateways likely used in OT/ICS environments. The root cause CWE-306 indicates the gateway exposes critical functionality without requiring authentication, allowing unauthorized users to perform privileged operations.
Affected Products
ABB AWIN GW100 rev.2 firmware versions 2.0-0 and 2.0-1; ABB AWIN GW120 firmware versions 1.2-0 and 1.2-1. The ENISA EUVD confirms these specific version strings. These industrial gateways are likely deployed in manufacturing, energy, or other industrial control system environments.
Remediation
ABB has published a security advisory available at https://search.abb.com/library/Download.aspx?DocumentID=4JNO000329&LanguageCode=en&DocumentPartId=&Action=Launch which should contain patch information and mitigation guidance. As an immediate workaround, organizations should ensure these gateways are not accessible from untrusted adjacent networks through proper network segmentation and access controls.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today