# ABB 800xA Base denial-of-service vulnerability patched

Published: 2026-05-19 · Severity: routine · Sectors: energy, manufacturing, infrastructure, government-national, defense, healthcare, technology
Canonical: https://vorant.io/reports/5383a1c4-af22-5fef-86dc-4017c623e292/abb-800xa-base-denial-of-service-vulnerability-patched

> Denial-of-service flaw in ABB 800xA Base crashes PC client/server services via crafted messages; no active exploitation reported.

ABB has disclosed a denial-of-service vulnerability in ABB 800xA Base affecting multiple versions across critical infrastructure platforms worldwide. An attacker with network access to the client/server network can send specially crafted messages via the CSLib TCP/IP protocol to crash 800xA services running on PC-based nodes, forcing automatic restarts. The flaw stems from improper buffer validation (CWE-1284). Affected versions include 800xA Base 6.1.1-2 and earlier, 6.1.1-3, 6.2.0-0, and 6.0.3-9 and earlier. Controllers are not affected. ABB reports no active exploitation in the wild at the time of disclosure.

The vulnerability is exploitable remotely only if IPSec is not enabled on the network. With IPSec enabled, an attacker would require physical access to plant malware first. ABB has released patches: 800xA Base 6.2.0-0, 6.1.1-3, and 6.0.3-10 (via RollUp in September 2025). Organizations can enable IPSec as a workaround pending patching. Repeated service restarts may indicate active attack.

## Mentioned in this report

- Vulnerabilities: CVE-2024-3036

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-24-177-01

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/5383a1c4-af22-5fef-86dc-4017c623e292/abb-800xa-base-denial-of-service-vulnerability-patched.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup