ABB Cylon FLXeon 9.3.4 Default Credentials Vendor: ABB Ltd. Product web page: https://www.global.abb Affected version: FLXeon Series (FBXi Series, FBTi Series, FBVi Series) CBX Series (FLX Series) CBT Series CBV Series ABB UC32 Series Main Plant Controllers (Cylon's UnitronUC32.xx) Firmware: <=9.3.4 Summary: BACnet® Smart Building Controllers. ABB's BACnet portfolio features a series of BACnet® IP and BACnet MS/TP field controllers for ASPECT® and INTEGRA™ building management solutions. ABB BACnet controllers are designed for intelligent control of HVAC equipment such as central plant, boilers, chillers, cooling towers, heat pump systems, air handling units (constant volume, variable air volume, and multi-zone), rooftop units, electrical systems such as lighting control, variable frequency drives and metering. The FLXeon Controller Series uses BACnet/IP standards to deliver unprecedented connectivity and open integration for your building automation systems. It's scalable, and modular, allowing you to control a diverse range of HVAC functions. Desc: The ABB Cylon FLXeon BACnet controller uses a weak set of default administrative credentials that can be guessed in remote password attacks and gain full control of the system. Tested on: Linux Kernel 5.4.27 Linux Kernel 4.15.13 NodeJS/8.4.0 Express Vulnerability discovered by Gjoko 'LiquidWorm' Krstic @zeroscience Advisory ID: ZSL-2025-5919 Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2025-5919.php 21.04.2024 -- $ cat project P R O J E C T .| | | |'| ._____ ___ | | |. |' .---"| _ .-' '-. | | .--'| || | _| | .-'| _.| | || '-__ | | | || | |' | |. | || | | | | || | ____| '-' ' "" '-' '-.' '` |____ $ cat cyloncreds.txt admin:cylonctl cxpro:siteguide UC32Net:CylonCtl