ABB Ability Camera Connect versions ≤1.5.0.14 shipped with outdated VLC media player…

ABB Ability Camera Connect versions ≤1.5.0.14 shipped with outdated VLC media player 2.2.4, exposing 23 CVEs spanning memory corruption and code execution flaws.

ABB disclosed that its Ability Camera Connect industrial camera management software bundled VLC media player 2.2.4, a version affected by 23 publicly known vulnerabilities dating from 2017 to 2024. The flaws span heap-based buffer overflows, integer underflows, use-after-free conditions, and binary hijacking, primarily exploitable via crafted media files (MKV, MP4, ASF, FLAC) or malicious MMS streams. Successful exploitation could enable denial-of-service attacks or arbitrary code execution with user privileges.

ABB emphasizes that Camera Connect is deployed exclusively in air-gapped, isolated operational technology environments with no internet connectivity or external network access. This deployment model significantly reduces the attack surface, as remote exploitation vectors are eliminated and media ingestion is restricted to trusted sources under administrative control. ABB has released Camera Connect version 1.5.0.15, which updates the embedded VLC component to address all identified vulnerabilities. Customers can remediate by updating VLC independently or upgrading to the latest Camera Connect release.

The affected sectors include chemical, energy, critical manufacturing, transportation, and commercial facilities—domains where OT security and supply-chain component hygiene are critical. While the vendor asserts low exploitability due to operational constraints, the presence of decades-old vulnerabilities in widely deployed ICS software underscores the persistent challenge of third-party component lifecycle management in industrial control systems.

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-146-05