# ABB AWIN Gateways Authentication Bypass and DoS Vulnerabilities

> Critical vulnerabilities in ABB AWIN GW100 and GW120 gateways could allow unauthenticated attackers to reboot devices or extract sensitive configuration data.

- Published: 2026-04-30T16:41:24.000Z
- Severity: high
- Category: Vulnerabilities
- Tags: CVE-2025-13777, CVE-2025-13778, CVE-2025-13779, ABB, ICS, Manufacturing
- Author: Runtime Rebel Intel
- Primary source: https://www.cisa.gov/news-events/ics-advisories/icsa-26-120-05
- Canonical: https://runtimerebel.com/blog/abb-awin-gateways-authentication-bypass-and-dos-vulnerabilities

## Key points

- Immediate impact: Unauthenticated attackers can remotely reboot devices or extract sensitive configuration data from industrial gateways.
- Affected systems: ABB AWIN GW100 rev.2 and GW120 running firmware versions 1.2-0, 1.2-1, 2.0-0, and 2.0-1.
- Remediation: Update to ABB AWIN firmware 2.1-0 or 2.0-0 as specified by the vendor security advisory.

## Overview of ABB AWIN Vulnerabilities

Industrial automation leader ABB has disclosed several vulnerabilities affecting its AWIN gateway series, which are primarily utilized within the critical manufacturing sector. According to [CISA Advisory ICSA-26-120-05](https://www.cisa.gov/news-events/ics-advisories/icsa-26-120-05), these flaws could enable unauthenticated attackers to perform unauthorized queries, reveal sensitive system configurations, or trigger a remote reboot of the affected hardware. The vulnerabilities impact the ABB AWIN GW100 rev.2 and the GW120 gateways, both of which are used globally to bridge industrial communication protocols.

While the vulnerabilities have high [CVSS](/glossary#cvss) scores, the attack vector is limited to the network layer (AV:A), meaning an attacker must have access to the local or adjacent network to exploit these [CVE](/glossary#cve) identifiers. There is currently no evidence of public exploitation in the wild.

## Technical Analysis: Authentication and Session Validation

The most significant threats are [CVE-2025-13777](https://nvd.nist.gov/vuln/detail/CVE-2025-13777) and [CVE-2025-13779](https://nvd.nist.gov/vuln/detail/CVE-2025-13779), both of which carry a base score of 8.3. 

### CVE-2025-13777: Authentication Bypass by Capture-Replay
This flaw involves improper session validation that allows an attacker to bypass authentication mechanisms. By capturing and replaying session data, a malicious actor could gain unauthorized access to the device management interface. This type of bypass often serves as a precursor to more destructive activities, such as [Lateral Movement](/glossary#lateral-movement) within the industrial control system environment.

### CVE-2025-13778: Remote Reboot and DoS
[CVE-2025-13778](https://nvd.nist.gov/vuln/detail/CVE-2025-13778) is a medium-severity vulnerability resulting from missing authentication for a critical function. This allows an unauthenticated user to issue a command that forces the gateway to reboot. In an industrial context, a sudden reboot can lead to a loss of visibility into process data, potentially disrupting manufacturing operations or causing a temporary [DDoS](/glossary#ddos)-like state for telemetry monitoring.

### Impacts of CVE-2025-13779: Sensitive Configuration Leaks
When defenders attempt to **detect ABB gateway configuration leak** scenarios, they must look for unauthenticated queries targeting the device's management ports. This vulnerability allows an attacker to extract the entire system configuration. This data often contains IP addresses, routing tables, and service details that provide a roadmap for an [APT](/glossary#apt) or other sophisticated actors to plan further stages of a Cyberattack.

## Mitigation and ABB AWIN GW100 firmware update instructions

ABB has released firmware updates to address these vulnerabilities. Organizations should prioritize these updates to **mitigate ICS authentication bypass in ABB devices** and prevent unauthorized access to sensitive telemetry data. 

### Patch Requirements
- **ABB AWIN GW100 rev.2:** Update to firmware version 2.1-0 (Product ID: 3BNP102988R1).
- **ABB AWIN GW120:** Update to firmware version 2.0-0 (Product ID: 3BNP103003R1).

Asset owners should refer to the [ABB PSIRT security advisory 4JNO000329](https://search.abb.com/library/Download.aspx?DocumentID=4JNO000329&LanguageCode=en&DocumentPartId=&Action=Launch) for detailed installation procedures and to verify hardware compatibility.

### Defensive Strategies
Beyond patching, CISA recommends several proactive measures to align with [Zero Trust](/glossary#zero-trust) principles:
- **Isolate Control Networks:** Ensure that industrial gateways and control systems are not directly accessible from the internet. Use firewalls to segment the business network from the production environment.
- **Secure Remote Access:** If remote access is required, utilize a secure VPN. Remember that the VPN itself must be monitored and patched regularly to prevent it from becoming a single point of failure.
- **Network Monitoring:** Implement a [SIEM](/glossary#siem) or an [EDR](/glossary#edr) solution capable of detecting anomalous traffic patterns, such as repeated reboot commands or unusual configuration queries on adjacent networks. 

Following these [MITRE ATT&CK](/glossary#mitre-att-ck) aligned defensive strategies will reduce the [SOC](/glossary#soc) workload and enhance the resilience of critical manufacturing infrastructure.

**Related:** [ABB Symphony Plus Engineering: Fix PostgreSQL RCE Vulnerabilities](/blog/abb-symphony-plus-engineering-fix-postgresql-rce-vulnerabilities), [Multiple DoS/RCE Vulnerabilities in Yokogawa CENTUM VP R6, R7](/blog/multiple-dos-rce-vulnerabilities-in-yokogawa-centum-vp-r6-r7)

---

AI-generated analysis from the primary source above; not human-reviewed before publication — verify anything operational against the original (https://runtimerebel.com/editorial). Quote with attribution and a link to the canonical URL: https://runtimerebel.com/blog/abb-awin-gateways-authentication-bypass-and-dos-vulnerabilities