ABB Ability Camera Connect vulnerable to 23 VLC flaws
ABB Ability Camera Connect versions ≤1.5.0.14 shipped with outdated VLC media player 2.2.4, exposing 23 CVEs spanning memory corruption and code execution flaws.
Sourcecisa.gov — open the original
What to check
- Applies to
- The 21 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- A public exploit is recorded for CVE-2017-8311 (poc) and CVE-2018-11529 (weaponized); no exploitation in the wild is recorded.
ABB disclosed that its Ability Camera Connect industrial camera management software bundled VLC media player 2.2.4, a version affected by 23 publicly known vulnerabilities dating from 2017 to 2024. The flaws span heap-based buffer overflows, integer underflows, use-after-free conditions, and binary hijacking, primarily exploitable via crafted media files (MKV, MP4, ASF, FLAC) or malicious MMS streams. Successful exploitation could enable denial-of-service attacks or arbitrary code execution with user privileges.
ABB emphasizes that Camera Connect is deployed exclusively in air-gapped, isolated operational technology environments with no internet connectivity or external network access. This deployment model significantly reduces the attack surface, as remote exploitation vectors are eliminated and media ingestion is restricted to trusted sources under administrative control. ABB has released Camera Connect version 1.5.0.15, which updates the embedded VLC component to address all identified vulnerabilities. Customers can remediate by updating VLC independently or upgrading to the latest Camera Connect release.
The affected sectors include chemical, energy, critical manufacturing, transportation, and commercial facilities—domains where OT security and supply-chain component hygiene are critical. While the vendor asserts low exploitability due to operational constraints, the presence of decades-old vulnerabilities in widely deployed ICS software underscores the persistent challenge of third-party component lifecycle management in industrial control systems.
Mentioned in this report
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-146-05
Free public brief. The indicators are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs