CVE-2023-1258

MEDIUM

ABB Flow-X Firmware < 4.0 - Unauthenticated Sensitive Information Exposure via Web Service

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2023-1258. PoCs published by Paul Smith.

AI-analyzed exploit summary This exploit targets CVE-2023-1258, an information exposure vulnerability in ABB FlowX versions before V4.00. It fetches and parses XML logs from the target URL to extract user login information.

Description

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ABB Flow-X firmware on Flow-X embedded hardware (web service modules) allows Footprinting.This issue affects Flow-X: before 4.0.

Exploits (1)

exploitdb WORKING POC
by Paul Smith · pythonwebappshardware
https://www.exploit-db.com/exploits/51603

This exploit targets CVE-2023-1258, an information exposure vulnerability in ABB FlowX versions before V4.00. It fetches and parses XML logs from the target URL to extract user login information.

Classification
Working Poc 90%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Reliable
Target: ABB Flow-X all versions before V4.00
No auth needed
Prerequisites: Network access to the target ABB FlowX device
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (2)

Core 2

Scores

CVSS v3 5.3
EPSS 0.0388
EPSS Percentile 88.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-200
Status published
Products (8)
abb/flow-x\/c_firmware < 3.2.6
abb/flow-x\/k_firmware < 3.2.6
abb/flow-x\/m_firmware < 3.2.6
abb/flow-x\/p_firmware < 3.2.6
abb/flow-x\/s_firmware < 3.2.6
abb/flow-x\/t_firmware < 3.2.6
abb/flow-x\/web_firmware < 3.2.6
abb/flow-x_r_firmware < 3.2.6
Published Mar 31, 2023
Tracked Since Feb 18, 2026