CVE-2021-26401 AMD CVE debrief

Who should care

OT/ICS operators and administrators running ABB M2M Gateway ARM600 firmware or ABB M2M Gateway SW, especially where deployments use AMD-based host processors. Security teams responsible for industrial gateway lifecycle management, patching, and platform inventory should also review exposure.

Technical summary

The supplied advisory text describes CVE-2021-26401 as a flaw in certain AMD EPYC, Ryzen, Threadripper, and Athlon processors related to the LONGJMP assembly command. In ABB’s CSAF advisory ICSA-25-105-08, the affected products are ABB M2M Gateway ARM600 firmware versions 4.1.2 through 5.0.3 and ABB M2M Gateway SW versions 5.0.1 through 5.0.3. The vendor notes that ARM600 servers include Intel processors, but some SW installations may be deployed in AMD processor environments. The recommended mitigation is to avoid servers with AMD processors vulnerable to CVE-2021-26401 and the related AMD issues named by ABB in the same guidance.

Defensive priority

Medium

Recommended defensive actions

• Inventory ABB M2M Gateway ARM600 firmware and ABB M2M Gateway SW versions and confirm whether any systems fall within the affected ranges listed in the advisory.
• Verify the underlying processor architecture for ARM600 SW deployments and avoid AMD processor environments identified by ABB as vulnerable in the mitigation guidance.
• Follow ABB’s remediation and the referenced CISA ICS recommended practices for segmentation, least privilege, and defense-in-depth around industrial gateways.
• Prioritize remediation for internet-reachable or operationally sensitive deployments, but treat the issue primarily as an architecture and platform exposure check rather than a generic software-only defect.
• Document any compensating controls and validate that affected systems are covered by your asset and lifecycle management process.

Evidence notes

This debrief is based on the supplied CISA CSAF advisory ICSA-25-105-08 and the associated references included in the corpus. The advisory publication and modification timestamps provided are 2025-04-07T10:30:00Z. The corpus states the vulnerability could lead to arbitrary code execution and recommends avoiding AMD processors vulnerable to CVE-2021-26401 in ARM600 SW environments. No KEV listing is present in the supplied enrichment.

Official resources