Read the docs
TI-2023-05315 Aliases CVE-2023-5778GHSA-j29v-23r4-r42c

Missing Length Check

Priority MEDIUM 46CWE-130Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Improper handling of length parameter inconsistency vulnerability in ABB Freelance Controller DCP, ABB Freelance Controller AC700, ABB Freelance Controller AC800, and ABB Freelance Controller AC900. This issue affects Freelance Controller DCP: through 2013, 2013 SP1, 2016, 2016 SP1, 2019, and 2019 SP1; Freelance Controller AC700: through 2013, 2013 SP1, 2016, 2016 SP1, 2019, and 2019 SP1; Freelance Controller AC800: through 2013, 2013 SP1, 2016, 2016 SP1, 2019, and 2019 SP1; Freelance Controller AC900: through 2013, 2013 SP1, 2016, 2016 SP1, 2019, and 2019 SP1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0046 40th percentileScored 2026-11-07
Fix Fixed Freelance Controller DCP (ABB): 2019 SP1 FP1, 2024Freelance Controller AC700 (ABB): 2019 SP1 FP1, 2024+2 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ABBFreelance Controller DCPup to 2013; 2013 SP1; 2016; 2016 SP1; 2019; 2019 SP12019 SP1 FP1, 2024Patch availableCNA
ABBFreelance Controller AC700up to 2013; 2013 SP1; 2016; 2016 SP1; 2019; 2019 SP12019 SP1 FP1, 2024Patch availableCNA
ABBFreelance Controller AC800up to 2013; 2013 SP1; 2016; 2016 SP1; 2019; 2019 SP12019 SP1 FP1, 2024Patch availableCNA
ABBFreelance Controller AC900up to 2013; 2013 SP1; 2016; 2016 SP1; 2019; 2019 SP12019 SP1 FP1, 2024Patch availableCNA
  • Freelance Controller DCP VendorABB Affected up to 2013; 2013 SP1; 2016; 2016 SP1; 2019; 2019 SP1 Fixed in 2019 SP1 FP1, 2024 Patch available CNA
  • Freelance Controller AC700 VendorABB Affected up to 2013; 2013 SP1; 2016; 2016 SP1; 2019; 2019 SP1 Fixed in 2019 SP1 FP1, 2024 Patch available CNA
  • Freelance Controller AC800 VendorABB Affected up to 2013; 2013 SP1; 2016; 2016 SP1; 2019; 2019 SP1 Fixed in 2019 SP1 FP1, 2024 Patch available CNA
  • Freelance Controller AC900 VendorABB Affected up to 2013; 2013 SP1; 2016; 2016 SP1; 2019; 2019 SP1 Fixed in 2019 SP1 FP1, 2024 Patch available CNA

Remediation

  • Fix · CNA Freelance Controller DCP (ABB) Fixed in 2019 SP1 FP1, 2024
  • Fix · CNA Freelance Controller AC700 (ABB) Fixed in 2019 SP1 FP1, 2024
  • Fix · CNA Freelance Controller AC800 (ABB) Fixed in 2019 SP1 FP1, 2024
  • Fix · CNA Freelance Controller AC900 (ABB) Fixed in 2019 SP1 FP1, 2024

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-5778
  2. 2026-10-03 Alias added: GHSA-j29v-23r4-r42c

References

Other 1

  • TI-2019-03985 ABB MicroSCADA Pro SYS600 Missing Authentication for Critical Function CVSS 3.1CRITICAL 9.8
  • TI-2019-05127 The ABB IDAL HTTP server is vulnerable to a buffer overflow when a long Host header is… CVSS 3.1HIGH 8.8
  • TI-2024-05845 Remote code execution in ABB ASPECT-Enterprise CVSS 4.0CRITICAL 9.4
  • TI-2024-34459 Service control in ABB ASPECT-Enterprise CVSS 4.0HIGH 8.8
  • TI-2024-05758 unauthorized file access CVSS 4.0CRITICAL 9.4
  • TI-2022-00806 ABB Flow Computer and Remote Controllers Path Traversal Vulnerability in Totalflow TCP protocol can lead to root access CVSS 3.1CRITICAL 9.8
See all 262 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences