ABB Flow Computer and Remote Controllers Path Traversal Vulnerability in Totalflow TCP protocol can lead to root access

published 2022-07-21 4y ago modified 2026-06-17 4mo ago also EUVD-2022-15934

cvss: 8.1; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 16.9%; EPSS 16.9% chance of exploitation in 30 days, percentile 97%
public exploits: 0; none known

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in flow computer and remote controller products of ABB ( RMC-100 (Standard), RMC-100-LITE, XIO, XFCG5 , XRCG5 , uFLOG5 , UDC) allows an attacker who successfully exploited this vulnerability could insert and run arbitrary code in an affected system node.

Patch / fix

fixed in 7

ABB RMC-100 (Standard) 2105457-037
ABB RMC-100-LITE 2106229-011
ABB XIO 2106198-008
ABB XFCG5 2105805-016
ABB XRCG5 2105864-016
ABB uFLOG5 2105298-024
ABB UDC 2106177-007

Is CVE-2022-0902 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Exploit prediction

16.92% chance of exploitation in the next 30 days, higher than 97% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by	version	score	vector
CNA	3.1	8.1	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

ABB RMC-100 (Standard)
ABB RMC-100-LITE
ABB XIO
ABB XFCG5
ABB XRCG5
ABB uFLOG5
ABB UDC

Classification

Weakness

CWE-22 Improper Limitation of a Pathname to a Restricted Directory
CWE-77 Improper Neutralization of Special Elements used in a Command

References

search.abb.com /library/Download.aspx?DocumentID=9AKK108467A0927&LanguageCode=en&DocumentPartId=&Action=Launch&_ga
mitigation, vendor-advisory

Sources

CVE List CVE-2022-0902
NVD CVE-2022-0902

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.