CVE-2023-5778

Estado: AplazadaCrítica (9.2)—

Improper handling of length parameter inconsistency vulnerability in ABB Freelance Controller DCP, ABB Freelance Controller AC700, ABB Freelance Controller AC800, and ABB Freelance Controller AC900.

This issue affects Freelance Controller DCP: through 2013, 2013 SP1, 2016, 2016 SP1, 2019, and 2019 SP1; Freelance Controller AC700: through 2013, 2013 SP1, 2016, 2016 SP1, 2019, and 2019 SP1; Freelance Controller AC800: through 2013, 2013 SP1, 2016, 2016 SP1, 2019, and 2019 SP1; Freelance Controller AC900: through 2013, 2013 SP1, 2016, 2016 SP1, 2019, and 2019 SP1.

CVSS

Versión: 4.0
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:C/RE:H/U:X
Puntuación base: 9.2

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 0.29%
Percentil entre todas las CVEs puntuadas: 19
Fecha de la puntuación: 5/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

ExplotaciónT1190 Exploit Public-Facing Applicationinitial access85 %
Impacto principalT1499.004 Application or System Exploitationimpact75 %

Vector AV:N/PR:N/UI:N indica explotación remota sin privilegios (T1190). CWE-130 (improper length handling) en controladores industriales sugiere negación de servicio (T1499.004) por procesamiento anómalo de parámetros.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Filter Network Traffic Vulnerability Scanning Privileged Account Management Network Segmentation Limit Access to Resource Over Network Application Isolation and Sandboxing

Tecnologías afectadas (4)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

ABB — Freelance Controller Ac700^AI ABB — Freelance Controller Ac800^AI ABB — Freelance Controller Ac900^AI ABB — Freelance Controller DCP^AI

CWE

CWE-130

Referencias

https://search.abb.com/library/Download.aspx?DocumentID=7PAA010706&LanguageCode=en&DocumentPartId=&Action=Launch

JSON original (NVD)

Mostrar

{
  "id": "CVE-2023-5778",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-5778",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-09-18T14:12:56.535431Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "cybersecurity@ch.abb.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "cybersecurity@ch.abb.com",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "USER",
          "baseScore": 9.2,
          "Automatable": "YES",
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "valueDensity": "CONCENTRATED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:C/RE:H/U:X",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "NONE",
          "subIntegrityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "HIGH",
          "vulnAvailabilityImpact": "HIGH",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "HIGH",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "cybersecurity@ch.abb.com",
      "affectedData": [
        {
          "vendor": "ABB",
          "product": "Freelance Controller DCP",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "custom",
              "lessThanOrEqual": "2013"
            },
            {
              "status": "affected",
              "version": "2013 SP1",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "2016",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "2016 SP1",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "2019",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "2019 SP1",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "2019 SP1 FP1",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "2024",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "ABB",
          "product": "Freelance Controller AC700",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "custom",
              "lessThanOrEqual": "2013"
            },
            {
              "status": "affected",
              "version": "2013 SP1",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "2016",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "2016 SP1",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "2019",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "2019 SP1",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "2019 SP1 FP1",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "2024",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "ABB",
          "product": "Freelance Controller AC800",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "custom",
              "lessThanOrEqual": "2013"
            },
            {
              "status": "affected",
              "version": "2013 SP1",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "2016",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "2016 SP1",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "2019",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "2019 SP1",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "2019 SP1 FP1",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "2024",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "ABB",
          "product": "Freelance Controller AC900",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "custom",
              "lessThanOrEqual": "2013"
            },
            {
              "status": "affected",
              "version": "2013 SP1",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "2016",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "2016 SP1",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "2019",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "2019 SP1",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "2019 SP1 FP1",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "2024",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-09-18T14:17:14.870",
  "references": [
    {
      "url": "https://search.abb.com/library/Download.aspx?DocumentID=7PAA010706&LanguageCode=en&DocumentPartId=&Action=Launch",
      "source": "cybersecurity@ch.abb.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cybersecurity@ch.abb.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-130"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Improper handling of length parameter inconsistency vulnerability in ABB Freelance Controller DCP, ABB Freelance Controller AC700, ABB Freelance Controller AC800, and ABB Freelance Controller AC900.\n\nThis issue affects Freelance Controller DCP: through 2013, 2013 SP1, 2016, 2016 SP1, 2019, and 2019 SP1; Freelance Controller AC700: through 2013, 2013 SP1, 2016, 2016 SP1, 2019, and 2019 SP1; Freelance Controller AC800: through 2013, 2013 SP1, 2016, 2016 SP1, 2019, and 2019 SP1; Freelance Controller AC900: through 2013, 2013 SP1, 2016, 2016 SP1, 2019, and 2019 SP1."
    }
  ],
  "lastModified": "2026-09-18T17:49:08.457",
  "sourceIdentifier": "cybersecurity@ch.abb.com"
}