CVE-2025-13778: ABB AWIN Gateway Auth Bypass Vulnerability

CVE-2025-13778 Overview

CVE-2025-13778 is a missing authentication for critical function vulnerability affecting ABB AWIN GW100 rev.2 and ABB AWIN GW120 industrial gateway devices. This vulnerability allows unauthenticated attackers on an adjacent network to access critical device functions without proper authentication, potentially leading to denial of service conditions that could disrupt industrial operations.

Critical Impact
Unauthenticated attackers on the adjacent network can exploit this vulnerability to cause high availability impact, potentially disrupting industrial gateway operations and connected systems.

Affected Products

ABB AWIN GW100 rev.2 versions 2.0-0 and 2.0-1
ABB AWIN GW120 versions 1.2-0 and 1.2-1

Discovery Timeline

2026-03-13 - CVE-2025-13778 published to NVD
2026-03-16 - Last updated in NVD database

Technical Details for CVE-2025-13778

Vulnerability Analysis

This vulnerability is classified as CWE-306 (Missing Authentication for Critical Function), indicating that the affected ABB AWIN gateway devices fail to properly authenticate users before allowing access to sensitive administrative or operational functions. In industrial environments, these gateway devices serve as critical communication bridges between operational technology (OT) networks and enterprise systems, making authentication bypass particularly dangerous.

The adjacent network attack vector means an attacker must have network-level access to the same local network segment as the vulnerable device. While this limits remote exploitation from the internet, it presents significant risk in industrial environments where network segmentation may be incomplete or where attackers have gained initial access to the OT network.

Root Cause

The root cause of CVE-2025-13778 lies in the firmware's failure to implement proper authentication checks before processing requests to critical device functions. The ABB AWIN GW100 rev.2 and GW120 devices expose administrative or operational interfaces that should require authentication but instead process requests from any adjacent network source without credential verification.

Attack Vector

An attacker positioned on the same network segment as the vulnerable ABB AWIN gateway can send specially crafted requests directly to the device's critical functions. Since no authentication is required, the attacker can manipulate device operations without valid credentials. The vulnerability specifically enables high availability impact, suggesting attackers can cause denial of service conditions that may disrupt the gateway's communication bridging capabilities and affect connected industrial systems.

The attack requires no user interaction and no prior privileges, making exploitation straightforward once network adjacency is achieved. Typical attack scenarios include insider threats, compromised adjacent systems, or physical access to the industrial network infrastructure.

Detection Methods for CVE-2025-13778

Indicators of Compromise

Unusual or unexpected traffic patterns targeting ABB AWIN gateway management interfaces from unauthorized sources
Access attempts to administrative functions from IP addresses outside of approved management stations
Service disruptions or availability issues on ABB AWIN GW100 rev.2 or GW120 devices without clear operational cause
Network reconnaissance activity targeting industrial gateway devices on the OT network segment

Detection Strategies

Implement network traffic monitoring on segments containing ABB AWIN devices to detect unauthorized access attempts
Configure SIEM alerts for any access to ABB AWIN gateway management interfaces from non-whitelisted IP addresses
Deploy industrial-specific intrusion detection systems (IDS) capable of identifying anomalous OT protocol traffic
Monitor device logs for authentication failures or access to critical functions from unexpected sources

Monitoring Recommendations

Establish baseline network behavior for ABB AWIN devices and alert on deviations
Implement continuous availability monitoring for affected gateway devices to detect denial of service attempts
Review access logs regularly for signs of unauthorized function access
Consider deploying network-based anomaly detection specifically tuned for industrial control system environments

How to Mitigate CVE-2025-13778

Immediate Actions Required

Consult the ABB Security Advisory for official guidance and firmware updates
Implement strict network segmentation to isolate ABB AWIN devices from general network access
Restrict adjacent network access to authorized management stations only using firewall rules or VLANs
Monitor affected devices for signs of exploitation while planning remediation

Patch Information

ABB has released a security advisory addressing this vulnerability. Organizations should download and review the official security document from ABB to obtain the latest firmware versions and specific patching instructions. The advisory is available at the ABB Security Document Download page.

Affected versions requiring updates include:

ABB AWIN GW100 rev.2: versions 2.0-0 and 2.0-1
ABB AWIN GW120: versions 1.2-0 and 1.2-1

Workarounds

Implement network-level access controls using firewalls or access control lists (ACLs) to restrict which devices can communicate with ABB AWIN gateways
Deploy the devices within isolated VLAN segments accessible only to authorized systems and personnel
Use jump hosts or bastion servers for administrative access to minimize direct network exposure
Consider implementing additional network-based authentication mechanisms at the perimeter of the gateway's network segment

bash

# Example network segmentation configuration (conceptual)
# Restrict access to ABB AWIN devices to authorized management VLAN only
# Configure on network switch/firewall protecting the OT segment

# Permit only authorized management station
permit ip host 10.10.50.10 host 10.10.100.20
# Deny all other adjacent network access to gateway
deny ip 10.10.0.0/16 host 10.10.100.20