CVE-2023-24329 ABB CVE debrief

Who should care

ABB ARM600 administrators, OT/ICS operators, network security teams, and anyone managing ABB M2M Gateway systems or supporting engineering workstations in industrial environments.

Technical summary

According to the supplied CISA CSAF advisory, the flaw affects the urllib.parse component of Python: if a URL begins with blank characters, blocklisting methods may be bypassed. The advisory lists affected ABB M2M Gateway ARM600 firmware versions 4.1.2 through 5.0.3 and ABB M2M Gateway SW versions 5.0.1 through 5.0.3. The published CVSS vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, reflecting authenticated network-reachable abuse with integrity impact.

Defensive priority

Medium. Prioritize remediation if the affected gateway is reachable from less-trusted networks, supports authenticated remote administration, or sits on paths that handle URL-based allow/deny logic.

Recommended defensive actions

• Verify whether ABB M2M Gateway ARM600 firmware 4.1.2 through 5.0.3 or ABB M2M Gateway SW 5.0.1 through 5.0.3 is deployed.
• Limit exposure: avoid direct internet access; if remote connectivity is required, use private APN, VPN, or DMZ-based termination as described in the advisory.
• Apply strict firewall allowlisting so only required hosts, ports, and protocols can reach the system.
• Change any default credentials, use strong non-reused passwords, and restrict administrator/root use to only when required.
• Keep engineering/configuration PCs updated, and virus-scan files and firmware before transferring them into the OT environment.
• Maintain tested backups of device configurations and related assets, stored securely and validated regularly.
• Use continuous monitoring and remove or disable unnecessary accounts, services, ports, and communication paths.
• Follow ABB’s cyber security deployment guidance and CISA’s industrial control system best practices referenced in the advisory.

Evidence notes

This debrief is based only on the supplied CISA CSAF advisory ICSA-25-105-08 and the ABB references it includes. The advisory explicitly states the issue is a urllib.parse URL blocklisting bypass involving blank-leading URLs, identifies ABB M2M Gateway ARM600 firmware versions 4.1.2 through 5.0.3 and ABB M2M Gateway SW versions 5.0.1 through 5.0.3 as affected, and provides the published CVSS 6.5 medium vector. The public advisory date used here is 2025-04-07.

Official resources