ABB released patches for nine UEFI firmware vulnerabilities in B&R industrial PCs that…
ABB released patches for nine UEFI firmware vulnerabilities in B&R industrial PCs that allow network attackers to execute code, DoS, or steal data.
ABB has disclosed nine vulnerabilities (CVE-2023-45229 through CVE-2023-45237) affecting the UEFI firmware in multiple B&R industrial PC product lines, including APC and PPC series devices deployed globally in energy sector environments. The flaws reside in the EDK2 Network Package used by the Preboot eXecution Environment (PXE) and include buffer overflows, out-of-bounds reads, infinite loops, and weak TCP sequence number generation. Successful exploitation requires network access and could enable remote code execution, denial-of-service attacks, DNS cache poisoning, or information disclosure.
ABB has released firmware updates for most affected models (versions 1.09–2.16 depending on model); the APC910 will not receive a patch and users must rely on mitigations. The vendor recommends disabling PXE in UEFI settings if not required, and restricting IPv6 traffic on control network firewalls if PXE is necessary. CISA emphasizes that affected systems should be isolated from the internet and protected by defense-in-depth controls. No active exploitation of these vulnerabilities on ABB products has been reported at the time of advisory publication.
Mentioned in this report
Detection guidance
PXE/TFTP Boot Service Reachable on Industrial Control Network Segment
Detects inbound network connections to PXE/TFTP boot service ports (DHCP, TFTP, PXE redirection) that could expose the vulnerable EDK2 Network Package in B&R APC/PPC UEFI firmware to remote exploitation; PXE should be disabled unless explicitly required. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: PXE/TFTP Boot Service Reachable on Industrial Control Network Segment
id: d30e52f9-c3e0-5079-a830-0ce42619a24b
status: experimental
description: Detects network traffic to PXE/TFTP/DHCP boot service ports that may
expose the vulnerable EDK2 Network Package used by B&R industrial PC UEFI firmware
(CVE-2023-45229 through CVE-2023-45237) to remote exploitation. ABB recommends disabling
PXE if not required.
references:
- ABB Cybersecurity Advisory - B&R Industrial PC UEFI vulnerabilities
author: Vorant
tags:
- attack.T1190
logsource:
category: firewall
detection:
selection:
dst_port:
- 67
- 68
- 69
- 4011
condition: selection
fields:
- src_ip
- dst_ip
- dst_port
- action
falsepositives:
- Legitimate PXE boot deployment via Windows Deployment Services or SCCM OS imaging
- Scheduled firmware/OS re-imaging maintenance windows on the OT network
- Network boot used by diskless workstations in the same broadcast domain
level: low
IPv6 PXE Network Boot Traffic to UEFI Firmware Boot Service
Flags PXE/TFTP boot traffic transported over IPv6 toward industrial PC firmware, matching ABB's specific mitigation guidance to restrict IPv6 on control network firewalls because the vulnerable EDK2 Network Package's IPv6/TCP stack (weak sequence numbers, buffer overflows, infinite loops) is exploitable via PXE over IPv6. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: IPv6 PXE Network Boot Traffic to UEFI Firmware Boot Service
id: 7d894b98-fadd-511d-ad58-ceebe9050e3b
status: experimental
description: Detects PXE/TFTP boot service traffic carried over IPv6 toward B&R industrial
PC firmware. This matches the attack surface for CVE-2023-45229 through CVE-2023-45237,
EDK2 Network Package flaws (buffer overflow, weak TCP sequence generation, infinite
loop) reachable via IPv6 PXE. ABB explicitly recommends restricting IPv6 on control
network firewalls when PXE must remain enabled.
references:
- ABB Cybersecurity Advisory - B&R Industrial PC UEFI vulnerabilities
author: Vorant
tags:
- attack.T1190
- attack.T1499
logsource:
category: firewall
detection:
selection:
dst_port:
- 69
- 4011
- 546
- 547
ip_version: 6
condition: selection
fields:
- src_ip
- dst_ip
- dst_port
- ip_version
- action
falsepositives:
- Environments that intentionally use IPv6 for PXE network boot / OS deployment
- Dual-stack network imaging infrastructure with IPv6 enabled by design
level: medium
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-141-02
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free