CVE-2022-0902

Deeper analysis

CVE-2022-0902 is a path traversal and command injection vulnerability affecting multiple ABB flow computer and remote controller products, specifically the RMC-100 (Standard), RMC-100-LITE, XIO, XFCG5, XRCG5, uFLOG5, and UDC. The issues are tracked under CWE-22 and CWE-77 and arise from improper pathname restrictions to directories combined with inadequate neutralization of command elements, enabling an attacker to insert and execute arbitrary code on an affected node.

An unauthenticated attacker with network access can exploit the flaw, although the attack requires high complexity. Successful exploitation grants the ability to run arbitrary code, resulting in high impact to confidentiality, integrity, and availability on the targeted industrial device.

ABB has released an advisory (document 9AKK108467A0927) that describes the affected products and provides mitigation guidance; practitioners should obtain the advisory directly from ABB's library for patch or configuration details.

The associated EPSS score rose from low values to a peak of 0.0680 on 2025-12-11 before receding to the current 0.0225, indicating a period of increased exploitation interest after disclosure.