ABB Cylon FLXeon 9.3.5 (variant.js) Unauthenticated System Information Disclosure


Vendor: ABB Ltd.
Product web page: https://www.global.abb                   
Affected version: FLXeon Series (FBXi Series, FBTi Series, FBVi Series)
                  CBX Series (FLX Series)
                  CBT Series
                  CBV Series
                  Firmware: <=9.3.5

Summary: BACnetÂ® Smart Building Controllers. ABB's BACnet portfolio features a
series of BACnetÂ® IP and BACnet MS/TP field controllers for ASPECTÂ® and INTEGRAâ„¢
building management solutions. ABB BACnet controllers are designed for intelligent
control of HVAC equipment such as central plant, boilers, chillers, cooling towers,
heat pump systems, air handling units (constant volume, variable air volume, and
multi-zone), rooftop units, electrical systems such as lighting control, variable
frequency drives and metering.

The FLXeon Controller Series uses BACnet/IP standards to deliver unprecedented
connectivity and open integration for your building automation systems. It's scalable,
and modular, allowing you to control a diverse range of HVAC functions.

Desc: The ABB Cylon FLXeon BACnet controller's /api/variant endpoint exposes sensitive
system information, including the internal IP address, MAC address, device model, and
build type, without requiring authentication. The get() function gathers network
interface data using the os.networkInterfaces() API and returns it in the HTTP response,
potentially allowing unauthenticated clients to fingerprint internal infrastructure
and gain insight into the device's network configuration and hardware characteristics.

Tested on: Linux Kernel 5.4.27
           Linux Kernel 4.15.13
           NodeJS/8.4.0
           Express


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2025-5937
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2025-5937.php


21.04.2024

--


$ cat project

                 P   R   O   J   E   C   T

                        .|
                        | |
                        |'|            ._____
                ___    |  |            |.   |' .---"|
        _    .-'   '-. |  |     .--'|  ||   | _|    |
     .-'|  _.|  |    ||   '-__  |   |  |    ||      |
     |' | |.    |    ||       | |   |  |    ||      |
 ____|  '-'     '    ""       '-'   '-.'    '`      |____
â–‘â–’â–“â–ˆâ–ˆâ–ˆâ–ˆâ–ˆâ–ˆâ–ˆâ–“â–’â–‘â–‘â–’â–“â–ˆâ–ˆâ–ˆâ–ˆâ–ˆâ–ˆâ–ˆâ–“â–’â–‘ â–‘â–’â–“â–ˆâ–ˆâ–ˆâ–ˆâ–ˆâ–ˆâ–“â–’â–‘â–‘â–’â–“â–ˆâ–“â–’â–‘â–’â–“â–ˆâ–ˆâ–ˆâ–ˆâ–ˆâ–ˆâ–ˆâ–“â–’â–‘  
â–‘â–’â–“â–ˆâ–“â–’â–‘â–‘â–’â–“â–ˆâ–“â–’â–‘â–’â–“â–ˆâ–“â–’â–‘â–‘â–’â–“â–ˆâ–“â–’â–‘â–’â–“â–ˆâ–“â–’â–‘â–‘â–’â–“â–ˆâ–“â–’â–‘â–’â–“â–ˆâ–“â–’â–‘â–’â–“â–ˆâ–“â–’â–‘â–‘â–’â–“â–ˆâ–“â–’â–‘ 
â–‘â–’â–“â–ˆâ–“â–’â–‘â–‘â–’â–“â–ˆâ–“â–’â–‘â–’â–“â–ˆâ–“â–’â–‘â–‘â–’â–“â–ˆâ–“â–’â–‘â–’â–“â–ˆâ–“â–’â–‘â–‘â–’â–“â–ˆâ–“â–’â–‘â–’â–“â–ˆâ–“â–’â–‘â–’â–“â–ˆâ–“â–’â–‘â–‘â–’â–“â–ˆâ–“â–’â–‘ 
â–‘â–’â–“â–ˆâ–ˆâ–ˆâ–ˆâ–ˆâ–ˆâ–ˆâ–“â–’â–‘â–‘â–’â–“â–ˆâ–ˆâ–ˆâ–ˆâ–ˆâ–ˆâ–ˆâ–“â–’â–‘â–‘â–’â–“â–ˆâ–ˆâ–ˆâ–ˆâ–ˆâ–ˆâ–ˆâ–ˆâ–“â–’â–‘â–’â–“â–ˆâ–“â–’â–‘â–’â–“â–ˆâ–“â–’â–‘â–‘â–’â–“â–ˆâ–“â–’â–‘ 
â–‘â–’â–“â–ˆâ–“â–’â–‘â–‘â–’â–“â–ˆâ–“â–’â–‘â–’â–“â–ˆâ–“â–’â–‘â–‘â–’â–“â–ˆâ–“â–’â–‘â–’â–“â–ˆâ–“â–’â–‘â–‘â–’â–“â–ˆâ–“â–’â–‘â–’â–“â–ˆâ–“â–’â–‘â–’â–“â–ˆâ–“â–’â–‘â–‘â–’â–“â–ˆâ–“â–’â–‘ 
â–‘â–’â–“â–ˆâ–“â–’â–‘â–‘â–’â–“â–ˆâ–“â–’â–‘â–’â–“â–ˆâ–“â–’â–‘â–‘â–’â–“â–ˆâ–“â–’â–‘â–’â–“â–ˆâ–“â–’â–‘â–‘â–’â–“â–ˆâ–“â–’â–‘â–’â–“â–ˆâ–“â–’â–‘â–’â–“â–ˆâ–“â–’â–‘â–‘â–’â–“â–ˆâ–“â–’â–‘ 
â–‘â–’â–“â–ˆâ–ˆâ–ˆâ–ˆâ–ˆâ–ˆâ–ˆâ–“â–’â–‘â–‘â–’â–“â–ˆâ–“â–’â–‘â–‘â–’â–“â–ˆâ–“â–’â–‘â–’â–“â–ˆâ–“â–’â–‘â–‘â–’â–“â–ˆâ–“â–’â–‘â–’â–“â–ˆâ–“â–’â–‘â–’â–“â–ˆâ–“â–’â–‘â–‘â–’â–“â–ˆâ–“â–’â–‘ 
         â–‘â–’â–“â–ˆâ–ˆâ–ˆâ–ˆâ–ˆâ–ˆâ–ˆâ–ˆâ–“â–’â–‘â–’â–“â–ˆâ–ˆâ–ˆâ–ˆâ–ˆâ–ˆâ–“â–’â–‘ â–‘â–’â–“â–ˆâ–ˆâ–ˆâ–ˆâ–ˆâ–ˆâ–“â–’â–‘ 
         â–‘â–’â–“â–ˆâ–“â–’â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–’â–“â–ˆâ–“â–’â–‘â–‘â–’â–“â–ˆâ–“â–’â–‘â–’â–“â–ˆâ–“â–’â–‘â–‘â–’â–“â–ˆâ–“â–’â–‘
         â–‘â–’â–“â–ˆâ–“â–’â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–’â–“â–ˆâ–“â–’â–‘â–‘â–’â–“â–ˆâ–“â–’â–‘â–’â–“â–ˆâ–“â–’â–‘â–‘â–‘â–‘â–‘â–‘â–‘ 
         â–‘â–’â–“â–ˆâ–ˆâ–ˆâ–ˆâ–ˆâ–ˆâ–“â–’â–‘â–‘â–’â–“â–ˆâ–“â–’â–‘â–‘â–’â–“â–ˆâ–“â–’â–‘â–’â–“â–ˆâ–“â–’â–’â–“â–ˆâ–ˆâ–ˆâ–“â–’â–‘
         â–‘â–’â–“â–ˆâ–“â–’â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–’â–“â–ˆâ–“â–’â–‘â–‘â–’â–“â–ˆâ–“â–’â–‘â–’â–“â–ˆâ–“â–’â–‘â–‘â–’â–“â–ˆâ–“â–’â–‘
         â–‘â–’â–“â–ˆâ–“â–’â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–’â–“â–ˆâ–“â–’â–‘â–‘â–’â–“â–ˆâ–“â–’â–‘â–’â–“â–ˆâ–“â–’â–‘â–‘â–’â–“â–ˆâ–“â–’â–‘
         â–‘â–’â–“â–ˆâ–“â–’â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–‘â–’â–“â–ˆâ–ˆâ–ˆâ–ˆâ–ˆâ–ˆâ–“â–’â–‘ â–‘â–’â–“â–ˆâ–ˆâ–ˆâ–ˆâ–ˆâ–ˆâ–“â–’â–‘


$ curl -k https://7.3.3.1/api/variant
{"ipaddr":"192.168.1.10","mac":"00:00:00:00:xx:xx","variant":{"variant":"CBXi","onboardIo":true,"router":true,"ser485-ports":[["mstp","ctlmbus","none"],["ctlstat","none"]]}}