CVE-2025-13779: ABB AWIN Gateway Auth Bypass Vulnerability

CVE-2025-13779 Overview

CVE-2025-13779 is a missing authentication for critical function vulnerability affecting ABB AWIN GW100 rev.2 and ABB AWIN GW120 industrial gateway devices. This vulnerability allows an unauthenticated attacker with adjacent network access to interact with critical device functions without proper authentication, potentially leading to unauthorized access, data manipulation, and service disruption.

Critical Impact

Unauthenticated attackers on the adjacent network can access critical functions on affected ABB AWIN gateway devices, potentially compromising industrial control system environments and operational technology networks.

Affected Products

• ABB AWIN GW100 rev.2 versions 2.0-0 and 2.0-1
• ABB AWIN GW120 versions 1.2-0 and 1.2-1

Discovery Timeline

• 2026-03-13 - CVE-2025-13779 published to NVD
• 2026-03-16 - Last updated in NVD database

Technical Details for CVE-2025-13779

Vulnerability Analysis

This vulnerability falls under CWE-306 (Missing Authentication for Critical Function), which occurs when a device or application exposes critical functionality without requiring proper authentication. In the case of the ABB AWIN GW100 rev.2 and GW120 gateway devices, certain critical functions can be accessed by an attacker positioned on the adjacent network without presenting valid credentials.

The ABB AWIN gateway devices are designed for industrial wireless communication applications, serving as critical infrastructure components in operational technology (OT) environments. The missing authentication mechanism allows unauthorized users to potentially read sensitive configuration data, modify device settings, or disrupt normal operations.

The attack vector requires the attacker to be on an adjacent network, which in industrial environments could include anyone with physical access to the network segment where these gateways operate. This is particularly concerning in shared facility environments or where network segmentation is not properly implemented.

Root Cause

The root cause of this vulnerability is the absence of authentication controls for critical device functions exposed via network interfaces. The affected firmware versions fail to enforce proper authentication checks before allowing access to sensitive operations, creating an authentication bypass condition that can be exploited by adjacent network attackers.

Attack Vector

The attack requires adjacent network access to the vulnerable ABB AWIN gateway device. An attacker positioned on the same network segment can directly interact with the device's exposed critical functions without providing valid credentials. This could be achieved through:

• Physical connection to the industrial network segment
• Compromise of another device on the same network
• Exploitation of wireless connectivity in the deployment environment

Since the AWIN devices are wireless gateway solutions, the adjacent network requirement may extend to wireless attack vectors where an attacker could position themselves within radio range of the device.

The vulnerability does not require any privileges or user interaction to exploit, making it particularly dangerous in environments where network access controls are not strictly enforced.

Detection Methods for CVE-2025-13779

Indicators of Compromise

• Unexpected network connections to ABB AWIN gateway devices from unrecognized sources
• Configuration changes on AWIN GW100 or GW120 devices without corresponding administrative actions
• Unusual traffic patterns or access attempts to critical device functions
• Authentication logs (if available) showing access without proper credential validation

Detection Strategies

• Monitor network traffic to and from ABB AWIN gateway devices for unauthorized access patterns
• Implement network intrusion detection systems (IDS) to identify anomalous communication with affected devices
• Deploy asset discovery tools to maintain an accurate inventory of AWIN GW100 rev.2 and GW120 devices and their firmware versions
• Configure alerting for any configuration changes on industrial gateway devices

Monitoring Recommendations

• Establish baseline network behavior for AWIN gateway devices and alert on deviations
• Implement continuous monitoring of industrial network segments where vulnerable devices are deployed
• Enable and centralize logging from network devices and security appliances monitoring OT network segments
• Conduct regular security assessments of network segmentation between IT and OT environments

How to Mitigate CVE-2025-13779

Immediate Actions Required

• Identify all ABB AWIN GW100 rev.2 (versions 2.0-0, 2.0-1) and AWIN GW120 (versions 1.2-0, 1.2-1) devices in your environment
• Implement strict network segmentation to limit adjacent network access to these devices
• Apply firewall rules to restrict network access to authorized management systems only
• Review and enhance physical security controls for network segments containing vulnerable devices

Patch Information

ABB has published a security advisory addressing this vulnerability. Organizations should consult the ABB Security Advisory for detailed remediation guidance and firmware update information.

Contact ABB support for the latest firmware versions that address this vulnerability. Ensure firmware updates are tested in a non-production environment before deploying to production systems.

Workarounds

• Implement network access control lists (ACLs) to restrict which systems can communicate with AWIN gateway devices
• Deploy additional authentication mechanisms at the network layer using VPNs or 802.1X authentication
• Isolate affected devices on dedicated network segments with strict ingress and egress filtering
• Enable monitoring and logging for all access attempts to affected devices while awaiting patch deployment

# Example network segmentation using firewall rules (adjust to your environment)
# Restrict access to AWIN gateway device management interfaces
# Only allow connections from authorized management workstations

# Example iptables rules for Linux-based firewall
iptables -A FORWARD -d <AWIN_GATEWAY_IP> -s <AUTHORIZED_MGMT_IP> -j ACCEPT
iptables -A FORWARD -d <AWIN_GATEWAY_IP> -j DROP