The products are used in several different roles in a factory. The researchers found vulnerabilities in the COM and scripting interfaces of the WebWare Server products, which include the WebWare Server (including Data Collector and Interlink), WebWare SDK, ABB Interlink Module, S4 OPC Server, QuickTeach, RobotStudio S4, and RobotStudio Lite.

While there are no known exploits targeting these components, crafting an exploit would only require a medium skill level, ICS-CERT judged. The flaw could also be used for a denial-of-service attack and privilege escalation, according to an advisory issued by the US Industrial Control Systems Cyber Emergency Response Team (ICS-CERT).īut because the system is near the end of its lifecycle, ABB no longer supports it and does not plan to issue a patch, despite the risk that an attacker could remotely take over the industrial machine. Independent researchers Terry McCorkle and Billy Rios identified a buffer overflow vulnerability that could allow an attacker to execute arbitrary code and remotely gain control of the target machine.

Patch robotstudio