# Critical UEFI Firmware Flaws in ABB B&R Industrial PCs Enable Remote Code Execution and DoS Attacks


## The Threat


ABB has disclosed a critical cluster of nine vulnerabilities spanning its B&R industrial PC product line, affecting equipment deployed in critical infrastructure environments worldwide. The flaws reside in the UEFI firmware's Preboot eXecution Environment (PXE) component and the underlying EDK2 network stack, enabling unauthenticated network attackers to execute arbitrary code, trigger denial-of-service conditions, poison DNS caches, or extract sensitive data without requiring user interaction or elevated privileges.


The vulnerabilities stem from fundamental memory safety issues in network packet processing routines. CVE-2023-45229 represents an out-of-bounds read when the firmware parses DHCPv6 Advertise messages—a common network configuration protocol. Other flaws include improper memory buffer restrictions, infinite loop conditions, and the use of cryptographically weak random number generators in firmware authentication mechanisms. These are not isolated edge cases but systemic weaknesses in how the affected firmware handles untrusted network input.


Network-adjacent attackers can exploit these flaws by crafting malicious DHCP or PXE traffic during system boot or firmware update cycles. Organizations deploying ABB B&R PCs in manufacturing, energy distribution, water treatment, and other operational technology (OT) environments face immediate risk, particularly if systems are networked and reboot frequently or undergo scheduled firmware updates.


## Severity and Impact


| CVE ID | CVSS Score | CVSS Vector | CWE | Attack Vector | Authentication |

|--------|-----------|-------------|-----|----------------|-----------------|

| CVE-2023-45229 | 8.3 | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | CWE-125 (Out-of-bounds Read) | Network | None |

| CVE-2023-45230 | 8.3 | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | CWE-119 (Memory Buffer Boundary Violation) | Network | None |

| CVE-2023-45231 | 8.3 | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | CWE-835 (Infinite Loop) | Network | None |

| CVE-2023-45232 | 8.3 | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | CWE-330 (Weak PRNG) | Network | None |

| CVE-2023-45233 | 8.3 | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | CWE-125 | Network | None |

| CVE-2023-45234 | 8.3 | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | CWE-119 | Network | None |

| CVE-2023-45235 | 8.3 | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | CWE-835 | Network | None |

| CVE-2023-45236 | 8.3 | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | CWE-330 | Network | None |

| CVE-2023-45237 | 8.3 | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | CWE-119 | Network | None |


All vulnerabilities achieve an 8.3 CVSS base score—considered high severity. The network attack vector combined with low attack complexity and no authentication requirement means any network segment with visibility to an affected system during boot is a potential attack surface.


## Affected Products


ABB B&R industrial PC models impacted include:


  • APC Series: APC4100 (versions < 1.09), APC910 (versions ≤ 1.25), APC2200 (versions < 1.35), APC3100 (versions < 1.45)
  • PPC Series: PPC900 (versions < 2.16), PPC1200 (versions < 1.14), PPC2200 (versions < 1.35), PPC3100 (versions < 1.45)
  • Other Models: C80 (versions < 1.14), MPC3100 (versions < 1.24)

    • All listed systems contain the vulnerable EDK2 network stack components and PXE functionality. The broad product overlap indicates shared firmware codebases across ABB's industrial PC portfolio.


    ## Mitigations


    ABB has released patched firmware versions for most affected models:


  • Apply Firmware Updates: APC4100 (update to 1.09), C80 (1.14), MPC3100 (1.24), PPC1200 (1.14), PPC900 (2.16), APC2200 (1.35), PPC2200 (1.35), APC3100 (1.45), PPC3100 (1.45). Updates should be applied at the earliest opportunity following the process outlined in product user manuals.

  • Disable PXE Boot (Critical for Immediate Risk Reduction): The vulnerabilities exist specifically in the UEFI PXE component. If PXE functionality is not operationally required, disable it in UEFI firmware settings. This eliminates the attack surface entirely regardless of firmware version.

  • Network Segmentation: Restrict network access to affected systems using firewall rules and VLAN isolation. Limit DHCP and PXE traffic sources to trusted administrative networks only. Implement strict ingress controls on ports used for network booting and firmware updates.

  • Monitor for Suspicious Boot Activity: Enable logging and monitoring of PXE requests and DHCP transactions on networks containing ABB equipment. Anomalous DHCPv6 Advertise messages or boot attempts from unexpected sources may indicate exploitation attempts.

  • Special Consideration—APC910: ABB will not release a patch for the APC910 product line. Organizations relying on APC910 systems must treat firmware update and network isolation as mandatory mitigations. Systems should be prioritized for replacement or retired from networked environments if operationally feasible.

    • ## References


  • ABB CSAF Advisory: https://www.abb.com/en/technology/vulnerabilities
  • National Vulnerability Database (NVD): https://nvd.nist.gov/vuln/detail/CVE-2023-45229
  • EDK2 Project Security: https://github.com/tianocore/edk2/security

    • ---


    ## HackWire Analysis


    These vulnerabilities expose a critical weakness in how industrial equipment manufacturers approach firmware security. ABB B&R PCs are deployed across power grids, water treatment plants, manufacturing lines, and other OT environments where reliability trumps frequent patching cycles. The decision to issue no patch for APC910 is particularly concerning—it suggests a product line either nearing end-of-life or facing technical constraints that prevent remediation. Either way, organizations running APC910 systems face a permanent choice between accepting residual vulnerability or undertaking costly equipment replacement.


    The sheer number of CVEs (nine total) and their clustering across multiple product lines points to systemic issues in ABB's UEFI firmware supply chain. These are not novel vulnerability classes—out-of-bounds reads, memory corruption, and weak randomness generators have been well-understood problems for decades. Their presence in industrial equipment manufactured recently suggests either insufficient security review processes or rushed patch cycles that deprioritize security hardening.


    The attack vector—network-based DHCPv6 processing during boot—is particularly insidious in OT environments. Many industrial networks operate with outdated network segmentation, and DHCP poisoning attacks are difficult to detect in environments where equipment reboots unexpectedly for maintenance or firmware updates. An attacker positioned on the same network segment (via compromised industrial devices, rogue access points, or insider access) can exploit these flaws without leaving obvious traces.


    For defenders, the immediate priority should be verifying whether PXE functionality is actually needed in your deployments. In many industrial environments, PXE is enabled for convenience but rarely used—disabling it provides immediate protection without waiting for firmware updates or vendor patch cycles. Organizations unable to disable PXE should prioritize applying available patches and implementing strict network-layer controls to limit DHCP/PXE traffic sources.


    This incident is part of a larger trend: as OT equipment increasingly connects to corporate networks and receives remote management capabilities, the firmware security posture of industrial vendors has not kept pace. Expect more of these coordinated disclosure events until manufacturers treat firmware as seriously as they treat hardware reliability.


    — HackWire Editorial


    ## Related Coverage


  • Read more in our [Vulnerabilities](https://www.hackwire.news/category/vulnerabilities) coverage
  • Cross-reference with [Breaches](https://www.hackwire.news/category/breaches) and [Malware](https://www.hackwire.news/category/malware)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)