Read the docs
TI-2023-03108 Aliases CVE-2023-3321GHSA-32mx-3mqx-p47v

Code Execution through Writable Mosquitto Configuration File

Priority LOW 38CWE-15Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

A vulnerability exists by allowing low-privileged users to read and update the data in various directories used by the Zenon system. An attacker could exploit the vulnerability by using specially crafted programs to exploit the vulnerabilities by allowing them to run on the zenon installed hosts. This issue affects ABB Ability™ zenon: from 11 build through 11 build 106404.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00366 30th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ABBABB Ability™ zenon11 build – 11 build 106404—No fix listedCNA
  • ABB Ability™ zenon VendorABB Affected 11 build – 11 build 106404 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:abb:zenon:*:*:*:*:*:*:*:*up to 11.0.0VulnerableABB
  • cpe:2.3:a:abb:zenon:*:*:*:*:*:*:*:* Versions up to 11.0.0 Vulnerable ·ABB

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-3321
  2. 2026-10-03 Alias added: GHSA-32mx-3mqx-p47v

References

Advisory 1

  • TI-2022-15642 ABB Ability TM Operations Data Management Zenon Zenon Log Server file access control CVSS 3.1HIGH 8.2
  • TI-2023-03109 Code Execution through overwriting service executable in utilities directory CVSS 3.1HIGH 8.1
  • TI-2022-15644 ABB Ability TM Operations Data Management Zenon Zenon Log Server file access control CVSS 3.1HIGH 8.4
  • TI-2023-03111 Insecure deserialization in zenon internal DLLs CVSS 3.1HIGH 7.5
  • TI-2022-15643 ABB Ability TM Operations Data Management Zenon Zenon Log Server file access control CVSS 3.1MEDIUM 6.2
  • TI-2023-03110 Code Execution through overwriting project file on zenon engineering studio system CVSS 3.1MEDIUM 5.9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences