# ABB Building Automation Gateway Vulnerable to Session Hijacking—Critical Infrastructure Risk


## The Threat


ABB's EIBPORT line of building management gateways contains a serious session management vulnerability that allows authenticated attackers to extract and hijack active user sessions. The flaw, identified as CVE-2021-22291, stems from improper input validation during web page generation and enables an attacker to capture session identifiers, granting unauthorized access to the device's administrative interface.


EIBPORT devices are KNX-based building automation controllers deployed worldwide to manage heating, lighting, security, and access systems in commercial buildings, industrial facilities, and critical infrastructure. Once an attacker gains a valid session token, they can reconfigure the entire building's automation logic, alter security parameters, disable access controls, or manipulate climate systems—creating both operational disruption and physical safety risks.


The vulnerability requires the attacker to already have some level of authenticated access or the ability to trick a legitimate user into clicking a malicious link. However, given that building automation systems are frequently accessed over internal networks and sometimes exposed to the internet without proper segmentation, the practical attack surface is far wider than it initially appears. ABB has released firmware version 3.9.2 and later to patch the affected versions.


## Severity and Impact


| Attribute | Details |

|---|---|

| CVE ID | CVE-2021-22291 |

| CWE | CWE-79 (Improper Neutralization of Input During Web Page Generation – Cross-site Scripting) |

| CVSS v3.1 Score | 8.0 (HIGH) |

| CVSS Vector | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H |

| Attack Vector | Network |

| Attack Complexity | Low |

| Privileges Required | Low (authenticated user) |

| User Interaction | Required |

| Scope | Unchanged |

| Confidentiality Impact | High |

| Integrity Impact | High |

| Availability Impact | High |


## Affected Products


The following ABB EIBPORT versions running firmware earlier than 3.9.2 are vulnerable:


  • EIBPORT V3 KNX (Model 2CLA963710W1001) – versions < 3.9.2
  • EIBPORT V3 KNX (Model 2CSM256242R2001) – versions < 3.9.2
  • EIBPORT V3 KNX GSM (Model 2CLA963720W1001) – versions < 3.9.2

    • All versions below firmware 3.9.2 require immediate remediation. Organizations should verify their deployed EIBPORT model and firmware version through the device's web interface or administrative console.


    ## Mitigations


    Immediate Actions:

  • Apply ABB firmware update 3.9.2 or later to all affected EIBPORT devices at your earliest convenience
  • Verify the update installation by confirming the device reports the new firmware version

    • Network Segmentation:

  • Isolate building automation systems from direct internet exposure using a hardware firewall
  • Restrict EIBPORT web interface access to trusted internal networks only
  • Implement zero-trust network access controls for all building system administration

    • Access Controls:

  • Enforce strong, unique credentials for all EIBPORT administrative accounts
  • Disable default credentials and accounts immediately after deployment
  • Implement multi-factor authentication where the system supports it
  • Limit the number of users with administrative privileges to essential personnel only

    • Monitoring and Detection:

  • Monitor access logs for unusual session activity or repeated failed authentication attempts
  • Enable audit logging on the EIBPORT device if available
  • Alert on administrative configuration changes

    • General Security Practices:

  • Do not use building automation systems for general internet browsing, email, or instant messaging
  • Scan all portable devices and removable media for malware before connecting them to the control network
  • Conduct regular security assessments of building automation infrastructure
  • Maintain an inventory of all EIBPORT devices and their firmware versions

    • ## References


  • [ABB Official Advisory (CSAF)](https://www.cisa.gov/news-events)
  • [CVE-2021-22291 Details](https://nvd.nist.gov/)
  • [CWE-79: Improper Neutralization of Input During Web Page Generation](https://cwe.mitre.org/data/definitions/79.html)
  • [CISA Critical Infrastructure Security](https://www.cisa.gov/critical-infrastructure)

    • ---


    ## HackWire Analysis


    The EIBPORT vulnerability exposes a persistent blind spot in how organizations protect building automation infrastructure. These systems control physical access, climate, lighting, and security across critical facilities—yet they often receive less security attention than a typical web server. The fact that this flaw allows session hijacking isn't just a technical issue; it's a vector into the physical world.


    What makes this vulnerability particularly concerning is the risk of *chained attacks*. An attacker with a hijacked session could slowly reconfigure building security rules, disable alarm systems, or manipulate access credentials—all while appearing to be a legitimate administrator. A sophisticated adversary could create a foothold that persists for weeks before discovery.


    The authentication requirement (PR:L) might seem like adequate protection, but in practice, many building management systems run on older internal networks where lateral movement is trivial. A compromised workstation on the same network segment could supply the necessary authenticated context. The UI:R (user interaction required) factor is also weaker than it appears—credential phishing targeting building maintenance staff is a well-known attack vector.


    The global deployment footprint combined with the 8.0 CVSS score means this advisory should trigger immediate patching cycles, not delayed quarterly updates. Building system administrators should treat firmware updates with the same urgency as their IT colleagues apply to server patches. For organizations managing multiple facilities, this is also a reminder to maintain an accurate asset inventory and a patching schedule—gaps in either will leave buildings vulnerable.


    The advisory's recommendation for network segmentation is sound but often ignored. If your EIBPORT gateway is reachable from the internet or from untrusted corporate networks, firmware alone won't save you. Network architecture changes are harder than patching, but they're essential. — HackWire Editorial


    ## Related Coverage


  • Read more in our [Vulnerabilities](https://www.hackwire.news/category/vulnerabilities) coverage
  • Cross-reference with [Breaches](https://www.hackwire.news/category/breaches) and [Malware](https://www.hackwire.news/category/malware)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)