A critical authentication bypass vulnerability in specific ABB IP hardware allows unauthenticated attackers to execute unauthorized commands, posing a severe risk to operational security.

The vulnerability is identified as a Missing Authentication for Critical Function (CWE-306), which permits an unauthenticated, network-adjacent attacker to perform sensitive operations without providing valid credentials.

The ability for an unauthenticated user to access critical functions presents a severe risk of unauthorized configuration changes or operational disruption. With a CVSS score of 9.1, this vulnerability is classified as critical, as it could lead to total loss of control over the affected industrial hardware. Such compromises may result in significant downtime and potential safety risks within the environments where these devices are deployed.

Immediate Action: Consult the official ABB security advisory (Document ID 4TZ00000006007) to determine if a firmware update or hardware replacement is required for units within the affected serial number range.

Proactive Monitoring: Inspect network traffic logs for unauthorized access attempts directed at the management interfaces of the affected ABB devices.

Compensating Controls: Restrict network access to the management interfaces of these devices to trusted management subnets only using hardware firewalls or VLAN isolation.

Public Exploit Available: No (exploit_available unknown).

Given the critical CVSS severity score of 9.1 and the lack of authentication, immediate isolation of these devices from public or untrusted networks is mandatory. Administrators must review the serial numbers of their installed base against the affected range and coordinate with ABB support to apply the necessary security updates or remediations as soon as they become available.