ABB Zenon authentication bypass enables unauthorized system reboots
ABB Ability Zenon software contains an authentication bypass vulnerability allowing unauthorized system reboots, affecting versions 7.50 through 14 across critical infrastructure.
Sourcecisa.gov — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
ABB has disclosed a vulnerability in its Ability Zenon software platform affecting versions 7.50 through 14. The vulnerability exists in the Remote Transport Service component, specifically the zensyssrv.exe service that starts automatically in default configurations. An attacker who has already gained access to the network where the affected system is deployed can bypass authentication mechanisms and remotely trigger system reboots without authorization. While users are required to configure a password to utilize the Remote Transport Service, the vulnerability allows attackers to circumvent this protection.
The vulnerability is classified as a missing authentication issue for a critical function. Remote exploitation requires the attacker to have already compromised the network perimeter, limiting the attack surface to insider threats or actors who have gained initial network access through other means. ABB reports no evidence of active exploitation in the wild at the time of publication.
ABB recommends restricting network access to systems running the Zenon platform and evaluating whether the Remote Transport functionality is necessary. If not required, organizations should stop or terminate the zensyssrv.exe service. The vulnerability impacts critical infrastructure sectors including chemical, energy, healthcare, manufacturing, water, and IT systems deployed worldwide.
Mentioned in this report
Detection guidance
Suspicious Termination of ABB Zenon Remote Transport Service (zensyssrv.exe)
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects command-line service stop/kill actions targeting the ABB Zenon zensyssrv.exe process, which may indicate exploitation of the authentication bypass to disable the Remote Transport Service or mask further tampering. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Termination of ABB Zenon zensyssrv Service
logsource:
category: process_creation
product: windows
detection:
selection_process:
Image|endswith:
- \taskkill.exe
- \sc.exe
- \net.exe
- \net1.exe
- \powershell.exe
- \pwsh.exe
CommandLine|contains: zensyssrv
selection_action:
CommandLine|contains:
- stop
- /im
- /f
- Stop-Service
- kill
condition: selection_process and selection_action
falsepositives:
- Legitimate administrative maintenance stopping the Remote Transport Service as recommended
by ABB mitigation guidance
- Scheduled patching or service reconfiguration scripts
level: medium
tags:
- attack.t1489
- attack.impact
id: e68a9fbb-d1a0-570b-bd0f-ccf7cc18d254
status: experimental
author: Vorant
ABB Zenon Remote Transport Service Unexpected Stop (Service Control Manager)
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects Windows Service Control Manager events indicating the zensyssrv (ABB Zenon Remote Transport) service stopped unexpectedly, which may indicate exploitation of the missing-authentication vulnerability to disrupt the service or precede an unauthorized reboot. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: ABB Zenon zensyssrv Service Stopped Unexpectedly
logsource:
product: windows
service: system
detection:
selection:
Provider_Name: Service Control Manager
EventID:
- 7036
- 7035
- 7034
Message|contains: zensyssrv
condition: selection
falsepositives:
- Planned maintenance or intentional disabling of the Remote Transport Service per
vendor hardening guidance
- Service crash due to unrelated software fault
level: medium
tags:
- attack.t1489
- attack.impact
id: fd3b1004-adae-5f09-b3c0-643871900a4f
status: experimental
author: Vorant
System Reboot Initiated Shortly After zensyssrv.exe Network Activity
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects a system reboot/shutdown command execution occurring in close proximity to zensyssrv.exe process activity, consistent with exploitation of the ABB Zenon Remote Transport authentication bypass to force an unauthorized reboot. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Reboot Command Following ABB Zenon zensyssrv Activity
logsource:
category: process_creation
product: windows
detection:
selection_reboot:
Image|endswith:
- \shutdown.exe
CommandLine|contains:
- /r
- /f
- -r
selection_zenon:
Image|endswith: \zensyssrv.exe
condition: selection_reboot and selection_zenon
falsepositives:
- Legitimate scheduled reboots on systems running Zenon that coincide with normal
maintenance windows
- Administrator-initiated reboot for patching co-located with zensyssrv.exe process
presence
level: low
tags:
- attack.t1489
- attack.impact
id: 6400d617-67e5-5e5b-91af-ea5a226824af
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-146-03
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs