CVE-2022-42898 ABB CVE debrief

Who should care

OT and industrial network operators, ABB M2M Gateway administrators, and asset owners running ARM600 firmware 4.1.2 through 5.0.3 or ABB M2M Gateway SW 5.0.1 through 5.0.3—especially if remote access, VPN termination, or any internet-facing exposure is in place.

Technical summary

The CISA CSAF advisory ICSA-25-105-08 published on 2025-04-07 maps CVE-2022-42898 to ABB M2M Gateway ARM600 and ABB M2M Gateway SW. The advisory text states that PAC parsing in krb5 has integer overflows that may lead to denial of service. Affected products listed in the source are ABB M2M Gateway ARM600 firmware versions 4.1.2 through 5.0.3 and ABB M2M Gateway SW software versions 5.0.1 through 5.0.3. The source set provides mitigation guidance rather than a definitive remediation version.

Defensive priority

High for any affected deployment, and especially high where the device is remotely reachable or internet-exposed. Even though the plain-English description emphasizes denial of service, service interruption in OT environments can have operational impact beyond the host itself.

Recommended defensive actions

• Confirm whether any ABB M2M Gateway ARM600 firmware versions 4.1.2 through 5.0.3 or ABB M2M Gateway SW versions 5.0.1 through 5.0.3 are deployed.
• Avoid exposing the ARM600 or other system components to the internet; if exposure is unavoidable, restrict access so only the VPN port is open.
• Use a private cellular APN where feasible so traffic does not traverse the public internet.
• Apply firewall allowlisting: explicitly permit only required ports and protocols, and block everything else.
• If internet WAN transport is used for VPN tunnels, terminate connections in a segregated DMZ rather than directly on the ARM600 network segment.
• Change default credentials, use unique strong passwords, and limit administrator/root use to tasks that require it.
• Follow ABB cyber security deployment guidance and user manuals, keep supporting PCs updated, and virus-scan files before transferring them to the OT environment.
• Maintain validated backups and use continuous monitoring or intrusion detection to spot anomalous activity early.

Evidence notes

All product/version and mitigation statements are drawn from the supplied CISA CSAF advisory source item and its ABB references. The source explicitly lists affected ABB M2M Gateway ARM600 and ABB M2M Gateway SW version ranges, describes PAC parsing in krb5 integer overflows leading to denial of service, and provides mitigation guidance centered on network exposure reduction, firewall allowlisting, DMZ use, credential hygiene, monitoring, and backups. No fixed version or patch release is present in the supplied corpus.

Official resources