CVE-2024-13967: EIBPORT V3 Auth Bypass Vulnerability

CVE-2024-13967 Overview

CVE-2024-13967 is a session fixation vulnerability ([CWE-384]) affecting the integrated web server of the ABB EIBPORT V3 KNX building automation gateway. A successful attacker can gain unauthorized access to the configuration web page delivered by the device's web interface. The flaw impacts EIBPORT V3 KNX through version 3.9.8 and EIBPORT V3 KNX GSM through version 3.9.8. Because EIBPORT devices manage KNX building automation systems, exploitation can expose facility control functions to remote attackers over the network.

Critical Impact
Network-based attackers can hijack administrative sessions and reach the EIBPORT configuration interface, enabling control over connected KNX building automation systems.

Affected Products

ABB EIBPORT V3 KNX through 3.9.8
ABB EIBPORT V3 KNX GSM through 3.9.8
Integrated web server component delivering the configuration interface

Discovery Timeline

2025-06-04 - CVE-2024-13967 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2024-13967

Vulnerability Analysis

The vulnerability resides in the session management logic of the integrated web server that serves the EIBPORT configuration interface. The device fails to properly invalidate or regenerate session identifiers across authentication state transitions. An attacker who can supply or predict a session identifier used by a legitimate administrator can subsequently reuse that identifier to access the configuration web page. The flaw maps to [CWE-384] Session Fixation, where the server accepts attacker-influenced session tokens rather than issuing fresh identifiers upon authentication.

Root Cause

The root cause is improper session lifecycle handling in the embedded web server. The server does not rotate the session identifier when a user transitions from unauthenticated to authenticated state. This allows an external session identifier to remain valid and inherit the authenticated user's privileges. Combined with user interaction, such as clicking an attacker-supplied link, the weakness enables full takeover of the administrative session.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker sets a predetermined session identifier in the victim administrator's browser, often through a crafted link or referrer that targets the EIBPORT web interface. When the administrator authenticates, the device continues to use the fixed session identifier. The attacker then replays the same identifier from a remote host and reaches the configuration page without supplying credentials. From there the attacker can modify KNX automation parameters, alter device configuration, and pivot to connected building systems.

No verified proof-of-concept code is publicly available. Refer to the ABB security advisory for vendor technical details.

Detection Methods for CVE-2024-13967

Indicators of Compromise

Repeated requests to the EIBPORT configuration web page from multiple distinct source IP addresses sharing the same session cookie value.
Authentication events on EIBPORT devices followed by configuration changes originating from a different IP than the initial login.
Unexpected modifications to KNX automation logic, scenes, or scheduler entries within the EIBPORT configuration.

Detection Strategies

Inspect HTTP access logs from EIBPORT devices for session identifiers reused across geographically or topologically inconsistent sources.
Correlate administrator login timestamps with subsequent configuration write operations to detect session reuse.
Deploy network monitoring that fingerprints traffic to EIBPORT management ports and alerts on unauthorized external access attempts.

Monitoring Recommendations

Forward EIBPORT web server logs to a centralized logging platform for retention and correlation against authentication events.
Monitor egress and ingress traffic to building automation network segments for unsolicited connections to EIBPORT interfaces.
Alert on any administrative session activity outside defined maintenance windows or trusted source ranges.

How to Mitigate CVE-2024-13967

Immediate Actions Required

Restrict network access to EIBPORT V3 KNX and EIBPORT V3 KNX GSM management interfaces using firewall rules that permit only trusted administrative hosts.
Place EIBPORT devices behind a VPN or jump host and remove any direct exposure to the internet.
Force all administrators to log out and clear active browser sessions before re-authenticating to the device.

Patch Information

ABB has published a security advisory addressing this issue. Review the ABB security advisory document for fixed firmware versions and upgrade guidance for EIBPORT V3 KNX and EIBPORT V3 KNX GSM platforms running 3.9.8 and earlier.

Workarounds

Segment EIBPORT devices onto an isolated operational technology (OT) VLAN with no direct internet routing.
Require administrators to use a dedicated, hardened management workstation for EIBPORT configuration tasks.
Disable remote access features that are not strictly required, including the GSM-based remote management path on the GSM variant.
Instruct operators to avoid clicking external links while authenticated to the EIBPORT web interface to reduce the risk of session fixation through crafted URLs.

bash

# Example: restrict access to the EIBPORT management interface to a single admin subnet
iptables -A FORWARD -s 10.10.50.0/24 -d <EIBPORT_IP> -p tcp --dport 80 -j ACCEPT
iptables -A FORWARD -d <EIBPORT_IP> -p tcp --dport 80 -j DROP